Detect, Manage, and Respond to Security Alerts GH-500 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst finds a Dependabot alert for a vulnerability in a dependency that is no longer used in the codebase. The dependency is still listed in the package manifest. What is the best action?

   • AIgnore the alert because it is not a real risk.
   • BUpdate the dependency to the patched version even though it is unused.
   • CRemove the unused dependency from the package manifest and then dismiss the alert.
   • DDismiss the alert because the dependency is not used.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A developer receives a secret scanning alert for a GitHub personal access token (PAT) that was exposed in a commit. The PAT has been revoked. What should the developer do with the alert?

   • ADismiss the alert because the token is no longer valid.
   • BIgnore the alert because it is not a security risk.
   • CRotate the token again to be safe.
   • DLeave the alert open until the token is removed from history.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team wants to receive notifications in a Slack channel whenever a new code scanning alert is opened in any repository. Which approach should they use?

   • AEnable email notifications for all alerts and forward them to Slack.
   • BConfigure a GitHub webhook to send alert events to a Slack integration.
   • CManually copy alert details to Slack after reviewing them.
   • DUse a scheduled workflow that checks for new alerts and posts to Slack.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the recommended practice when dismissing a security alert?

   • AProvide a reason and document the decision
   • BDelete the alert permanently
   • CIgnore the alert and hope it goes away
   • DDismiss without any comment to save time
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a valid way to filter security alerts in the GitHub UI?

   • ABy repository size and language
   • BBy commit author and date
   • CBy alert type, severity, and status
   • DBy number of stars and forks
   Reveal Solution Discussion Select an answer first