Your organization has enabled Push Protection for all repositories. A developer reports that their push was blocked because it contained a GitHub personal access token. The developer insists the token is a false positive and needs to push it. You are a repository administrator. What is the correct way to allow this push while maintaining auditability?

Change the token's value in the commit to a placeholder and push.

Instruct the developer to use the 'Allow secret' link in the push error message, then review the audit log entry.

Temporarily disable Push Protection, have the developer push, then re-enable it.

Add the token to the repository's .gitignore file and push again.

A developer's push is blocked by Push Protection. The developer sees a message with a link. What information does the developer typically see in the message?

A link to a remediation guide and an option to allow the secret if permitted.

A list of all secrets in the repository.

The exact secret value and instructions to rotate it.

The commit SHA and the name of the secret scanning rule.

Your organization has enabled Push Protection for all repositories. A developer attempts to push a commit with a secret and is blocked. The developer does not see an option to allow the secret. What is the most likely reason?

The secret is not a supported type.

The developer is using an older version of Git.

The developer does not have bypass permissions for Push Protection.

Push Protection is not enabled for the repository.

A developer's push is blocked by Push Protection. The developer sees a message with a link. The developer clicks the link and sees a page with details about the secret. The developer has bypass permissions. However, the developer wants to avoid bypassing the secret because it is a real credential. What should the developer do?

Use the 'Allow secret' option and then delete the repository.

Allow the secret and then rotate it immediately.

Contact GitHub support to remove the secret from the commit.

Remove the secret from the commit and push the commit without it.

GitHubAdvanced Security (GH-500)

Domain 2Objective 2

Prevent Secret Exposure GH-500 Practice Questions (Page 2)

Part of the Configure and use Secret Protection (formerly secret scanning) domain, which accounts for 15-20% of the GH-500 exam.

25questions here

5free pages

7concepts

15-20%of the exam

Questions 6–10

6application · medium
Your organization has enabled Push Protection for all repositories. A developer reports that their push was blocked because it contained a GitHub personal access token. The developer insists the token is a false positive and needs to push it. You are a repository administrator. What is the correct way to allow this push while maintaining auditability?
Select an answer first
7application · medium
A developer's push is blocked by Push Protection. The developer sees a message with a link. What information does the developer typically see in the message?
Select an answer first
8application · medium
Your organization has enabled Push Protection for all repositories. A developer attempts to push a commit with a secret and is blocked. The developer does not see an option to allow the secret. What is the most likely reason?
Select an answer first
9expert · medium
A developer's push is blocked by Push Protection. The developer sees a message with a link. The developer clicks the link and sees a page with details about the secret. The developer has bypass permissions. However, the developer wants to avoid bypassing the secret because it is a real credential. What should the developer do?
Select an answer first
10application · medium
Your company is adopting GitHub Advanced Security. You want to prevent developers from accidentally committing secrets to a new repository. You enable secret scanning and want to block secrets at the source. What should you enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Prevent Secret Exposure GH-500 Practice Questions (Page 2)

Questions 6–10

A developer's push is blocked by Push Protection. The developer sees a message with a link. What information does the developer typically see in the message?

Your organization has enabled Push Protection for all repositories. A developer attempts to push a commit with a secret and is blocked. The developer does not see an option to allow the secret. What is the most likely reason?

Your company is adopting GitHub Advanced Security. You want to prevent developers from accidentally committing secrets to a new repository. You enable secret scanning and want to block secrets at the source. What should you enable?

Keep studying — Configure and use Secret Protection (formerly secret scanning)