What is the primary purpose of GitHub Dependency Review in a repository?

To automatically update dependencies and create pull requests for new versions

To scan the entire dependency tree for known vulnerabilities on a scheduled basis

To check dependency changes in a pull request for known vulnerabilities and license issues before merging

To enforce that all dependencies are pinned to exact versions in the lockfile

What should you do when a Dependabot pull request has a merge conflict?

Close the pull request and wait for Dependabot to recreate it

Delete the branch and create a new pull request manually

Use the 'Rebase' button in the pull request to automatically fix the conflict

Resolve the conflict manually by editing the files in the pull request

Where do you configure grouping for Dependabot updates?

In the dependency-review-config.yml file

In the repository's Dependabot configuration file (dependabot.yml)

In the repository settings under 'Dependabot'

In the GitHub Actions workflow file

What does the 'affected dependency graph' show in Dependency Review results?

A visual representation of how the dependencies changed in the pull request, including which files were affected

A list of all open Dependabot alerts for the repository

The entire dependency tree of the repository, including all transitive dependencies

A map of the repository's file structure showing where dependencies are used

GitHubAdvanced Security (GH-500)

Domain 3Objective 3

Secure Dependencies During Development GH-500 Practice Questions (Page 5)

Part of the Configure and use supply chain security (formerly Dependabot/Dependency Review) domain, which accounts for 15-20% of the GH-500 exam.

27questions here

6free pages

10concepts

15-20%of the exam

10 Concepts in This Objective

Dependency Review overview
Enabling Dependency Review
Interpreting Dependency Review results
Configuring Dependency Review
License and compliance validation
Dependency Review API and automation
Dependency update grouping
Auto-dismissing Dependabot alerts
Update strategies for Dependabot
Managing Dependabot pull requests

Questions 21–25

21foundation · easy
What is the primary purpose of GitHub Dependency Review in a repository?
Select an answer first
22foundation · easy
What should you do when a Dependabot pull request has a merge conflict?
Select an answer first
23foundation · easy
Where do you configure grouping for Dependabot updates?
Select an answer first
24foundation · easy
Which configuration file section is used to specify allowed licenses for Dependency Review?
Select an answer first
25foundation · easy
What does the 'affected dependency graph' show in Dependency Review results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.