Secure Dependencies During Development GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team uses Dependabot to keep their dependencies up to date. They want to ensure that Dependabot only updates the lockfile and does not modify the package manifest (e.g., package.json) when a new version is available. Which configuration should they use?

   • ASet 'versioning-strategy' to 'lockfile-only' in the dependabot.yml file for the package manager.
   • BSet 'schedule.interval' to 'daily' in the dependabot.yml file.
   • CSet 'update-types' to ['patch'] in the dependabot.yml file.
   • DSet 'open-pull-requests-limit' to 0 in the dependabot.yml file.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary use case for the Dependency Review API?

   • ATo automatically fix vulnerabilities in dependencies
   • BTo create new dependency review configurations
   • CTo list all repositories with Dependency Review enabled
   • DTo programmatically retrieve dependency review results for a pull request
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which criteria can be used to auto-dismiss Dependabot alerts?

   • AThe programming language and the repository size
   • BThe age of the alert and the number of open issues
   • CThe author of the dependency and the date of the last commit
   • DVulnerability severity and dependency scope
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes the role of Dependency Review in the software development lifecycle?

   • AIt provides a nightly report of all outdated dependencies in the repository
   • BIt acts as a gate that prevents merging pull requests with vulnerable or non-compliant dependency changes
   • CIt scans the source code for hardcoded secrets and credentials
   • DIt replaces the need for manual code review by automatically fixing vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of grouping Dependabot updates?

   • ATo increase the frequency of dependency updates
   • BTo prioritize security updates over version updates
   • CTo automatically merge all dependency updates without review
   • DTo reduce the number of pull requests by combining multiple dependency updates into one
   Reveal Solution Discussion Select an answer first