Detect, Prioritize, and Respond to Supply Chain Alerts GH-500 Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A developer receives a Dependabot alert for a vulnerable dependency. They want to fix it by updating to a patched version, but they are unsure if the update will break the application. What should they do?

   • AAsk Dependabot to automatically merge the update
   • BDismiss the alert and continue using the vulnerable version
   • CDirectly update the dependency in the main branch
   • DCreate a pull request with the dependency update and run the test suite
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does GitHub help you remediate a Dependabot alert by creating a pull request?

   • AIt generates a pull request that updates the dependency to a patched version
   • BIt sends an email with instructions to manually update the dependency
   • CIt creates a pull request that removes the dependency entirely
   • DIt automatically merges the pull request without review
   Reveal Solution Discussion Select an answer first