Secure Dependencies During Development GH-500 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team uses Dependabot to update their Python dependencies. They have a group configured for 'runtime' dependencies and another for 'dev' dependencies. They notice that Dependabot is creating separate pull requests for each dependency in the 'dev' group instead of grouping them. What is the most likely cause?

   • AThe 'dev' group is not configured with the correct 'patterns' to match the dev dependencies.
   • BThe 'open-pull-requests-limit' is set to a low number, preventing multiple PRs from being opened.
   • CThe 'schedule.interval' for the 'dev' group is set to 'daily', while the 'runtime' group is set to 'weekly'.
   • DThe 'versioning-strategy' for the 'dev' group is set to 'auto', which prevents grouping.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's legal team has approved a list of licenses that can be used in their projects. They want to ensure that no new dependency with a license outside this list is added. Which configuration should they use in Dependency Review?

   • AConfigure 'fail-on-severity' in the dependency-review.yml workflow to 'low'.
   • BConfigure 'deny-licenses' in the dependency-review.yml workflow with the approved license list.
   • CConfigure 'allow-licenses' in the dependency-review.yml workflow with the approved license list.
   • DConfigure 'paths-ignore' in the dependency-review.yml workflow to ignore all paths.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team wants to enable Dependency Review on their repository. They have already enabled Dependabot alerts. What is the next step to enable Dependency Review?

   • AEnable the 'Dependency Review' feature in the repository's 'Security & analysis' settings.
   • BAdd the dependency-review-action to a GitHub Actions workflow that triggers on 'pull_request' events.
   • CCreate a 'dependency-review.yml' file in the '.github' directory without any workflow.
   • DInstall the Dependency Review app from the GitHub Marketplace.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What does the 'lockfile-only' update strategy do in Dependabot?

   • AIt updates both the manifest and the lockfile to the latest version
   • BIt only updates dependencies that are listed in the lockfile, ignoring transitive dependencies
   • CIt locks the dependency versions to prevent any updates
   • DIt updates only the lockfile without changing the manifest file
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the Dependency Review results, what does a 'vulnerability alert' indicate?

   • AThe dependency has been deprecated by its maintainers
   • BA dependency has a known security vulnerability that is being introduced or updated in the pull request
   • CThe dependency's license is incompatible with the repository's license
   • DThe dependency is outdated and a newer version is available
   Reveal Solution Discussion Select an answer first