When setting up a security campaign, what does 'scope' refer to?

The number of developers assigned to the campaign

The set of repositories and alerts that the campaign will address

The time limit for completing the campaign

A security analyst is reviewing a list of Dependabot alerts and needs to decide which ones to address first. They have limited time and want to focus on the most urgent threats. Which information should they use to prioritize?

The EPSS score of each vulnerability

The number of dependencies in the repository

What is the purpose of configuring auto-dismiss rules for supply chain alerts?

To automatically fix all vulnerabilities

To reduce noise by automatically dismissing alerts that meet certain criteria

To send alerts to a different team

To block all pull requests that introduce vulnerabilities

What is the primary role of Dependabot alerts in the context of supply chain security?

To automatically fix all vulnerabilities without developer intervention

To provide a list of all dependencies in a repository

To flag vulnerable dependencies so that they can be reviewed and remediated

To block the use of any dependency that has ever had a vulnerability

A security team wants to automatically dismiss Dependabot alerts for vulnerabilities that are unlikely to be exploited, but they want to keep alerts for high-risk vulnerabilities. What should they configure?

Increase the Dependabot alert severity threshold

Auto-dismiss rules based on EPSS score thresholds

Disable Dependabot alerts for low-risk repositories

Manually dismiss alerts with low EPSS scores

GitHubAdvanced Security (GH-500)

Domain 3Objective 2

Detect, Prioritize, and Respond to Supply Chain Alerts GH-500 Practice Questions (Page 5)

Part of the Configure and use supply chain security (formerly Dependabot/Dependency Review) domain, which accounts for 15-20% of the GH-500 exam.

27questions here

6free pages

7concepts

15-20%of the exam

Questions 21–25

21foundation · easy
When setting up a security campaign, what does 'scope' refer to?
Select an answer first
22application · medium
A security analyst is reviewing a list of Dependabot alerts and needs to decide which ones to address first. They have limited time and want to focus on the most urgent threats. Which information should they use to prioritize?
Select an answer first
23foundation · easy
What is the purpose of configuring auto-dismiss rules for supply chain alerts?
Select an answer first
24foundation · easy
What is the primary role of Dependabot alerts in the context of supply chain security?
Select an answer first
25application · medium
A security team wants to automatically dismiss Dependabot alerts for vulnerabilities that are unlikely to be exploited, but they want to keep alerts for high-risk vulnerabilities. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.