Manage Access, Governance, and Supply Chain Security GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is required to provide a Software Bill of Materials (SBOM) for a critical application to a customer. The application is built from a monorepo with multiple packages. The company wants to generate the SBOM automatically as part of their CI/CD pipeline. What is the best approach?

   • AUse Dependabot alerts to generate a list of vulnerable dependencies and use that as the SBOM.
   • BUse the GitHub Dependency Graph to manually download the SBOM for each package and combine them.
   • CUse code scanning to generate an SBOM from the codebase.
   • DUse a GitHub Action to generate an SBOM for each package and publish them as artifacts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a dependency in the context of software supply chain security?

   • AA piece of software that your project relies on to function
   • BA repository that is forked from another
   • CA type of SBOM
   • DA security alert generated by GitHub
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer with write access to a repository reports that they can see a Dependabot alert for a critical vulnerability, but the 'Create security advisory' button is grayed out. The repository is owned by an organization. What is the most likely reason for this behavior?

   • AThe developer has write access, which allows viewing alerts but not managing them; only repository admins can create security advisories.
   • BThe developer must first enable GitHub Advanced Security for the repository before creating security advisories.
   • CThe repository has a custom security policy that disables security advisory creation for all members except organization owners.
   • DThe developer lacks the security manager role, which is required to create security advisories.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is required to provide a list of all open-source dependencies and their licenses for a compliance audit. They use GitHub Enterprise Cloud. What is the most efficient way to generate this information?

   • AUse the Dependency Graph to export a Software Bill of Materials (SBOM) for each repository.
   • BEnable Dependabot alerts and export the list of vulnerable dependencies.
   • CUse the GitHub API to retrieve the dependency graph for each repository and manually compile the data.
   • DRun a custom script that parses each repository's lock files and compiles a list of dependencies.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security manager needs to view and manage security alerts across all repositories in an organization, but they do not have admin access to each repository. What is the most appropriate way to grant them the necessary permissions?

   • AAdd the security manager to each repository as an admin.
   • BUse the delegated bypass feature to grant the security manager access to alerts.
   • CAssign the security manager role at the organization level.
   • DCreate a team with write access and add the security manager to that team.
   Reveal Solution Discussion Select an answer first