Prevent Secret Exposure GH-500 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What options does a developer have when their push is blocked by Push Protection?

   • AThey can remove the secret, or if they have permission, bypass the block to allow the push
   • BThey can force push the commit to override the block
   • CThey can only remove the secret and retry the push
   • DThey can contact GitHub support to allow the push
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your security team is reviewing secret scanning alerts. They notice that some alerts are marked as 'high confidence' while others are not. The team wants to focus on the most critical exposures first. What is the primary reason for the 'high confidence' designation?

   • AThe secret passed a validity check confirming it is active and usable.
   • BThe secret matches a custom pattern defined by your organization.
   • CThe secret was detected in a public repository.
   • DThe secret was found in a commit authored by a privileged user.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What determines whether a string of characters is detected as a secret by Push Protection?

   • AThe length of the string is greater than 10 characters
   • BThe string is surrounded by quotes or equals signs
   • CThe string is stored in a file named .env or config.json
   • DThe string matches a known pattern for a supported secret type
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of validity checks for secrets detected by secret scanning?

   • ATo encrypt the secret so it cannot be used
   • BTo determine if the secret is still active and usable
   • CTo determine the owner of the secret
   • DTo automatically revoke the secret from the provider
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   Your security team is reviewing secret scanning alerts. They see an alert for a secret that is marked as 'high confidence'. They also see an alert for a secret that is not marked as high confidence. The team has limited resources. What is the best approach to prioritize?

   • AInvestigate the non-high-confidence alert first because it may be a false positive.
   • BIgnore both alerts because they are not critical.
   • CInvestigate both alerts at the same time.
   • DInvestigate the high-confidence alert first because it is more likely to be a real exposure.
   Reveal Solution Discussion Select an answer first