Secure Dependencies During Development GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which configuration option allows Dependency Review to ignore a specific dependency in a pull request?

   • AAdding the dependency to a .gitignore file
   • BSetting a custom property in the repository settings
   • CUsing a dependency-review-config.yml file with an 'ignore' section listing the dependency
   • DCreating a label named 'ignore-dependency' and applying it to the pull request
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does Dependency Review do when it detects a dependency with a license that is not allowed by the organization's policy?

   • AIt automatically removes the dependency from the pull request
   • BIt sends a notification to the legal team
   • CIt blocks the pull request only if the license is GPL
   • DIt flags the dependency as a license violation in the review results
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization has a strict policy that no GPL-licensed dependencies may be used in their commercial software. They use Dependency Review to enforce this policy. A developer creates a pull request that adds a new dependency with a GPL license. What will happen when the Dependency Review check runs?

   • AThe check will pass, and the dependency will be added without any notification.
   • BThe check will fail, and the pull request will be blocked from merging if branch protection requires the check to pass.
   • CThe check will pass, but a warning will be displayed in the pull request comments.
   • DThe check will be skipped because the license is not in the allowlist.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security engineer is reviewing a Dependency Review report on a pull request. The report shows a vulnerability in a transitive dependency that is not directly used by the project. The engineer wants to understand the impact and decide whether to block the merge. What should they do?

   • AContact the dependency maintainer to ask for a fix before merging.
   • BCheck the dependency graph in the report to see which direct dependency introduces the transitive dependency and assess the risk.
   • CBlock the merge immediately because any vulnerability in a transitive dependency is critical.
   • DIgnore the vulnerability because it is in a transitive dependency and not directly used.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is about to merge a pull request that updates several dependencies. They want to ensure that the changes do not introduce any new vulnerable dependencies or license violations. What should they check before merging?

   • AThe Dependabot alerts page for the repository, which lists all known vulnerabilities.
   • BThe GitHub Actions logs for the build, which may show dependency errors.
   • CThe commit history of the pull request, to see which files were changed.
   • DThe Dependency Review check results on the pull request, which show vulnerabilities and license issues.
   Reveal Solution Discussion Select an answer first