A developer's push is blocked by Push Protection. The developer clicks the link in the error message and sees a page with details about the secret. What action can the developer take if they have bypass permissions?

Allow the secret and re-attempt the push.

Change the secret to a placeholder and push.

Report the secret to GitHub support.

Delete the secret from the commit and push.

How does GitHub determine which secret scanning alerts are considered high-confidence?

By the results of validity checks that confirm the secret is active

By the length of the secret string

By the file type where the secret is found

By the number of times the secret appears in the repository

Your security team is reviewing secret scanning alerts. They see an alert for a GitHub token that is marked as 'high confidence'. They also see an alert for a Slack webhook that is not marked as high confidence. The team has limited resources and must prioritize. What should they do?

Ignore both alerts because they are not critical.

Investigate the Slack webhook alert first because it is not high confidence.

Investigate the GitHub token alert first because it is high confidence.

Investigate both alerts simultaneously.

What is the purpose of prioritizing alerts for high-confidence secrets in GitHub secret scanning?

To focus security teams on the most critical exposures first

To encrypt high-confidence secrets in the repository

To hide low-confidence alerts from the security team

To automatically revoke high-confidence secrets

What happens to a git push that contains a secret when Push Protection is enabled on the repository?

The push is placed in a queue for manual review by a security team

The push is accepted, but the secret is automatically redacted in the remote repository

The push is rejected, and the developer receives an error message indicating the secret was found

The push is accepted, and an alert is created for the repository administrator

GitHubAdvanced Security (GH-500)

Domain 2Objective 2

Prevent Secret Exposure GH-500 Practice Questions (Page 5)

Part of the Configure and use Secret Protection (formerly secret scanning) domain, which accounts for 15-20% of the GH-500 exam.

25questions here

5free pages

7concepts

15-20%of the exam

Questions 21–25

21application · medium
A developer's push is blocked by Push Protection. The developer clicks the link in the error message and sees a page with details about the secret. What action can the developer take if they have bypass permissions?
Select an answer first
22foundation · easy
How does GitHub determine which secret scanning alerts are considered high-confidence?
Select an answer first
23expert · medium
Your security team is reviewing secret scanning alerts. They see an alert for a GitHub token that is marked as 'high confidence'. They also see an alert for a Slack webhook that is not marked as high confidence. The team has limited resources and must prioritize. What should they do?
Select an answer first
24foundation · easy
What is the purpose of prioritizing alerts for high-confidence secrets in GitHub secret scanning?
Select an answer first
25foundation · easy
What happens to a git push that contains a secret when Push Protection is enabled on the repository?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.