Prioritize and Manage Security Work at Scale GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Your team has been dismissing a particular type of code-scanning alert for months, but new team members keep questioning why. You want to ensure the rationale is clear and consistent. What should you do?

   • AStop dismissing these alerts and let them pile up in the queue.
   • BTell new team members to ask senior staff if they have questions.
   • CDocument the dismissal rationale in a shared wiki page and link it in the alert dismissal comments.
   • DCreate a rule that automatically dismisses these alerts without any comment.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary benefit of automated alert dismissal?

   • AIt reduces noise and manual effort by automatically dismissing alerts that meet predefined criteria
   • BIt prevents any new alerts from being created
   • CIt ensures that all alerts are fixed automatically
   • DIt increases the severity of all alerts
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes how a severity and remediation ruleset can be used in practice?

   • AIt can automatically dismiss all alerts from a specific tool without review
   • BIt can create a new repository for each alert
   • CIt can assign a 'critical' severity to alerts that match certain criteria, such as a specific vulnerability type
   • DIt can directly patch the vulnerable code in the repository
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your team has completed a large remediation campaign for a dependency vulnerability. You need to ensure that the process and decisions are documented for future reference and compliance. What should you do?

   • AWrite a post-mortem document that includes the campaign scope, actions taken, and rationale for any dismissed alerts.
   • BKeep the campaign open indefinitely so the alerts remain visible.
   • CSend an email summary to the team and consider it documented.
   • DDelete the campaign and its associated alerts to keep the repository clean.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to document the rationale for dismissing a security alert?

   • ATo increase the severity of the alert
   • BTo delete the alert from the system permanently
   • CTo automatically dismiss similar alerts in the future
   • DTo maintain auditability and knowledge sharing for future reference
   Reveal Solution Discussion Select an answer first