A developer is working on a critical security fix for a Dependabot alert. The fix requires updating a dependency that is used in multiple services. The developer wants to ensure the fix is safe before merging. What is the best approach?

Dismiss the alert if the tests pass locally.

Ask the security team to merge the pull request.

Merge the Dependabot pull request immediately to remediate the vulnerability quickly.

Run the test suite and perform a code review before merging the update.

A developer receives a Dependabot alert for a critical vulnerability in a production dependency. The alert shows a patched version is available, but the developer is unsure if the patch is compatible with the current codebase. What is the most appropriate first action?

Open the alert details and review the affected dependency and patched version, then test the update in a branch.

Immediately merge the Dependabot pull request without testing to remediate quickly.

Assign the alert to the security team without further action.

Dismiss the alert as a false positive to avoid noise.

An organization wants to ensure that only the security team can dismiss alerts, while developers can view them. What should an administrator configure?

Set repository permissions so that only users with 'write' access can dismiss alerts.

Use a GitHub App or API to enforce a policy that only the security team can dismiss alerts.

Use GitHub's built-in role 'Security manager' and assign it to the security team.

Configure a branch protection rule that requires security team approval to dismiss alerts.

A developer receives a secret scanning alert for a token that was exposed in a commit three weeks ago. The token is still active. What is the developer's primary responsibility?

Rotate the token immediately to invalidate the exposed secret.

Remove the token from the repository history and keep it active.

Dismiss the alert because the token is no longer used.

Ignore the alert because the token is not in a production environment.

What is the primary purpose of secret scanning in GitHub?

To enforce branch protection rules

To identify vulnerable dependencies

To detect exposed secrets such as tokens and keys in repositories

GitHubAdvanced Security (GH-500)

Domain 1Objective 3

Detect, Manage, and Respond to Security Alerts GH-500 Practice Questions (Page 4)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

33questions here

7free pages

9concepts

15-20%of the exam

Questions 16–20

16expert · hard
A developer is working on a critical security fix for a Dependabot alert. The fix requires updating a dependency that is used in multiple services. The developer wants to ensure the fix is safe before merging. What is the best approach?
Select an answer first
17application · medium
A developer receives a Dependabot alert for a critical vulnerability in a production dependency. The alert shows a patched version is available, but the developer is unsure if the patch is compatible with the current codebase. What is the most appropriate first action?
Select an answer first
18application · medium
An organization wants to ensure that only the security team can dismiss alerts, while developers can view them. What should an administrator configure?
Select an answer first
19application · medium
A developer receives a secret scanning alert for a token that was exposed in a commit three weeks ago. The token is still active. What is the developer's primary responsibility?
Select an answer first
20foundation · easy
What is the primary purpose of secret scanning in GitHub?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.