Prioritize and Manage Security Work at Scale GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main goal of a campaign-based remediation strategy?

   • ATo eliminate the need for security alerts entirely
   • BTo automatically fix all vulnerabilities without human review
   • CTo address each security alert individually with a unique solution
   • DTo address groups of related alerts efficiently at scale
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Your security team has just triaged 200 secret-scanning alerts. Half are confirmed false positives, and the other half are real secrets that need to be rotated. You want to efficiently handle both groups. What should you do?

   • AAssign all alerts to a single team and let them sort out the false positives.
   • BClose all alerts as false positives and reopen the real ones later.
   • CDismiss each false-positive alert individually, then create a campaign for the real secrets.
   • DSelect all false-positive alerts and dismiss them in bulk, then select all real alerts and assign them to the appropriate teams for rotation.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   Your team receives hundreds of code-scanning alerts weekly. Many are low-risk findings in test files, but a few critical ones in production code get lost in the noise. You want to ensure that critical alerts are always visible and actionable, while low-risk ones are deprioritized. What should you do?

   • AEnable the default GitHub ruleset and rely on its built-in severity assignments.
   • BDismiss all alerts in test files and only review alerts in production files.
   • CCreate a custom ruleset that assigns a 'critical' severity to alerts in production paths and 'low' severity to alerts in test paths, then apply it to the repository.
   • DManually triage each alert and change the severity to 'critical' or 'low' based on the file path.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   Your organization has a mix of repositories: some are critical production services, others are internal tools. You want to ensure that a 'critical' alert in an internal tool doesn't get the same attention as one in a production service, but you also don't want to miss real issues in internal tools. You need a scalable way to prioritize. What should you do?

   • AManually review each alert and decide its priority based on the repository.
   • BUse the same severity for all alerts and rely on the team to know which repositories are critical.
   • CCreate a ruleset that assigns higher severity to alerts in production repositories and lower severity to alerts in internal tool repositories, but still keeps them visible.
   • DDisable alerts for internal tool repositories entirely.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization uses a third-party tool that generates a known, harmless secret pattern in test configurations. These alerts flood your queue every day. You want to reduce noise without losing visibility into real secrets. What should you do?

   • AChange the severity of these alerts to 'low' so they are less visible.
   • BCreate an automated dismissal rule that dismisses alerts matching the known pattern, with a documented reason.
   • CDisable secret scanning for test configuration files.
   • DManually dismiss these alerts each day as they appear.
   Reveal Solution Discussion Select an answer first