Detect, Prioritize, and Respond to Supply Chain Alerts GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is setting up a security campaign to remediate alerts for a critical vulnerability across multiple repositories. They want to ensure that the campaign targets only repositories that use the affected library and that the remediation workflow includes automated testing. What should they configure?

   • ASet the campaign to automatically merge all pull requests
   • BInclude all repositories in the organization
   • CDefine the campaign scope to include only repositories with the affected dependency
   • DDisable automated testing during the campaign
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization has identified a critical vulnerability in a library used across 50 repositories. They want to remediate all affected repositories in a coordinated manner, with clear tracking and reporting. What should they use?

   • AA security campaign
   • BA single pull request across all repositories
   • CManual updates in each repository
   • DDependabot alerts only, without remediation
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is working on a Dependabot alert for a vulnerable dependency. They have created a pull request to update the dependency, but the tests are failing. What should they do?

   • AInvestigate the test failures and adjust the code as needed
   • BClose the pull request and dismiss the alert
   • CMerge the pull request anyway, as the update is necessary
   • DRevert the dependency update and keep the vulnerable version
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is overwhelmed by the number of Dependabot alerts. They want to reduce noise by automatically dismissing alerts that are unlikely to be exploited, but they are concerned about missing a high-risk vulnerability that has a low EPSS score due to limited data. What should they do?

   • ADisable auto-dismiss and manually review every alert
   • BSet auto-dismiss rules based on EPSS score, but also review alerts for critical dependencies manually
   • CDismiss alerts only for non-critical dependencies
   • DDismiss all alerts with EPSS scores below 0.5
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to remediate a large backlog of Dependabot alerts across multiple repositories. They need a systematic way to track and manage the remediation process, ensuring that alerts are addressed in a coordinated manner. What should they use?

   • AUse a single pull request to update all dependencies at once
   • BCreate a security campaign targeting the affected repositories
   • CManually create individual issues for each alert
   • DDisable Dependabot alerts to reduce noise
   Reveal Solution Discussion Select an answer first