Manage and Respond to Secret Protection Alerts GH-500 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team receives multiple Secret Protection alerts. One is for a production API key that is confirmed valid, and another is for a development database password that is also valid. The team has limited resources and must prioritize. Which alert should be addressed first?

   • AThe development database password, because it was detected first.
   • BThe production API key, because it protects a critical production service and has higher impact if compromised.
   • CThe development database password, because it is easier to rotate.
   • DBoth equally, because all secrets are equally important.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When is it appropriate to dismiss a Secret Protection alert?

   • AWhen the secret is older than 30 days
   • BWhen the repository is made private
   • CWhen the alert is a false positive or the secret is not a real risk
   • DWhen the secret has been revoked and rotated
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Secret Protection alert is currently 'resolved'. The security team later discovers that the secret was not actually rotated and is still valid. What should the team do?

   • ADismiss the alert to avoid confusion.
   • BLeave the alert resolved because it was already closed.
   • CReopen the alert and rotate the secret immediately.
   • DCreate a new alert for the same secret.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During triage, a security analyst sees two Secret Protection alerts: one for a production database password and one for a development API key. Both are confirmed valid. Which alert should be prioritized?

   • AThe production database password, because it protects critical infrastructure and has higher impact if compromised.
   • BBoth equally, because all secrets are equally important.
   • CThe development API key, because it is easier to rotate.
   • DThe development API key, because it was detected first.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When is it acceptable to ignore a Secret Protection alert?

   • AWhen the secret is older than 90 days
   • BWhen the alert is a false positive and has been dismissed with a reason
   • CWhen the secret is only in a private repository
   • DWhen the alert was created by a collaborator
   Reveal Solution Discussion Select an answer first