What is the developer's role when a Dependabot alert identifies a vulnerable dependency?

Ignore the alert if the dependency is not directly used

Delete the dependency from the manifest

Update the dependency to a patched version

A developer is triaging a code scanning alert that flags a potential SQL injection in a stored procedure. The developer knows that the stored procedure is only called from an internal admin interface that requires authentication. The developer wants to dismiss the alert. What is the best practice?

Fix the SQL injection by using parameterized queries, even though the interface is internal.

Dismiss the alert with the reason 'False positive' and a comment explaining the authentication requirement.

Ignore the alert because the interface is internal and requires authentication.

Dismiss the alert with the reason 'Won't fix' and a comment explaining the authentication requirement.

A developer attempts to push a commit that contains a hardcoded API key. Push protection is enabled for the repository, and the push is blocked. What should the developer do?

Remove the API key from the commit and push again.

Use the 'allow secret' option to push the commit anyway.

Force push the commit to bypass push protection.

Commit the key to a different branch and push that branch.

What is the purpose of configuring alert policies in GitHub?

To automatically fix all vulnerabilities

To change the programming language of the repository

To prevent any alerts from being created

To define how alerts are handled and who is notified

A security team is responsible for overseeing remediation of security alerts across multiple repositories. They want to track the status of all open alerts in a single dashboard. What is the most efficient way to achieve this?

Manually check each repository's alert page daily.

Enable email notifications for all alerts and review them in the inbox.

Use the GitHub API to query alerts across all repositories and build a custom dashboard.

Use a GitHub Actions workflow to export alerts to a CSV file.

GitHubAdvanced Security (GH-500)

Domain 1Objective 3

Detect, Manage, and Respond to Security Alerts GH-500 Practice Questions (Page 5)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

33questions here

7free pages

9concepts

15-20%of the exam

Questions 21–25

21foundation · easy
What is the developer's role when a Dependabot alert identifies a vulnerable dependency?
Select an answer first
22expert · hard
A developer is triaging a code scanning alert that flags a potential SQL injection in a stored procedure. The developer knows that the stored procedure is only called from an internal admin interface that requires authentication. The developer wants to dismiss the alert. What is the best practice?
Select an answer first
23application · medium
A developer attempts to push a commit that contains a hardcoded API key. Push protection is enabled for the repository, and the push is blocked. What should the developer do?
Select an answer first
24foundation · easy
What is the purpose of configuring alert policies in GitHub?
Select an answer first
25application · medium
A security team is responsible for overseeing remediation of security alerts across multiple repositories. They want to track the status of all open alerts in a single dashboard. What is the most efficient way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.