A security team wants to reduce alert fatigue by auto-dismissing alerts for vulnerabilities with low EPSS scores. However, they are concerned that some critical dependencies may have low EPSS scores but still be high-risk due to their usage. What should they do?

Dismiss all alerts for non-critical dependencies regardless of EPSS score

Configure auto-dismiss rules based on EPSS score, but exclude critical dependencies from the rules

Disable auto-dismiss and manually review all alerts

Set a very low EPSS threshold for auto-dismissal

When prioritizing supply chain alerts, how should EPSS scores be used?

To determine which dependencies to remove from the repository

To automatically dismiss alerts with low EPSS scores

To focus on vulnerabilities with the highest likelihood of exploitation first

To replace CVSS severity scores entirely

What is the most direct way to resolve a Dependabot alert for a vulnerable dependency?

Update the dependency to a patched version

Ignore the alert and wait for it to disappear

Change the license of the repository

Delete the repository and recreate it

Which of the following criteria can be used in an auto-dismiss rule for supply chain alerts?

The name of the repository owner

The programming language of the repository

The number of stars on the repository

The EPSS score of the vulnerability

What is a common workflow element you can define when configuring a security campaign?

The assignees responsible for remediating the alerts

The default branch name for the repository

The number of commits allowed in the repository

The color scheme of the campaign dashboard

GitHubAdvanced Security (GH-500)

Domain 3Objective 2

Detect, Prioritize, and Respond to Supply Chain Alerts GH-500 Practice Questions (Page 4)

Part of the Configure and use supply chain security (formerly Dependabot/Dependency Review) domain, which accounts for 15-20% of the GH-500 exam.

27questions here

6free pages

7concepts

15-20%of the exam

Questions 16–20

16expert · hard
A security team wants to reduce alert fatigue by auto-dismissing alerts for vulnerabilities with low EPSS scores. However, they are concerned that some critical dependencies may have low EPSS scores but still be high-risk due to their usage. What should they do?
Select an answer first
17foundation · easy
When prioritizing supply chain alerts, how should EPSS scores be used?
Select an answer first
18foundation · easy
What is the most direct way to resolve a Dependabot alert for a vulnerable dependency?
Select an answer first
19foundation · easy
Which of the following criteria can be used in an auto-dismiss rule for supply chain alerts?
Select an answer first
20foundation · easy
What is a common workflow element you can define when configuring a security campaign?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.