Manage and Respond to Secret Protection Alerts GH-500 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A Secret Protection alert flags a string that matches a GitHub token pattern. The developer says it is a test token, but the security team cannot verify that it is not used in production. What is the safest action?

   • ALeave the alert open and ask the developer to confirm in a follow-up.
   • BRemove the token from the repository and resolve the alert.
   • CTreat the token as valid and revoke it, then rotate it if needed.
   • DDismiss the alert as a false positive based on the developer's claim.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Secret Protection alert identifies a Slack webhook URL in a public repository. The webhook is still active and posts to a company channel. What is the first step in the remediation process?

   • ARemove the webhook URL from the repository and commit the change.
   • BDismiss the alert and monitor the channel for suspicious posts.
   • CRevoke the webhook in Slack and create a new one, then update the application configuration.
   • DChange the repository to private to hide the webhook URL.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is the most appropriate remediation action for a confirmed exposed API key?

   • AChange the key's permissions to read-only
   • BDelete the repository to remove the key
   • CIgnore the alert because the key is in a private repository
   • DRevoke the API key and rotate it with a new key
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Secret Protection alert flags a string that looks like an Azure Storage account key, but the developer explains it is a sample value from Microsoft documentation. The team wants to prevent future alerts for this exact string. What should they do?

   • ADisable secret scanning for the repository to avoid future alerts.
   • BRotate the sample key and update the documentation reference.
   • CAdd the string to a secret scanning allowlist to suppress future alerts for that exact value.
   • DDismiss the alert with the reason 'false positive' and add a comment that it is a documentation sample.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What should you do before deciding to resolve or dismiss a Secret Protection alert?

   • ACheck the repository's star count
   • BReview the secret's expiration date
   • CVerify the validity of the secret
   • DConfirm the alert was created by a bot
   Reveal Solution Discussion Select an answer first