A team wants to enforce that all pull requests pass both code scanning and secret scanning checks before merging. They have enabled code scanning with CodeQL and push protection for secrets. However, they notice that secret scanning does not appear as a required check in the branch protection rules. What is the likely reason?

Secret scanning is not a check that can be required in branch protection rules; it is a push-time control.

Secret scanning is only available for public repositories, not private ones.

Branch protection rules do not support required checks for security features.

The team has not enabled secret scanning for the repository.

What is the primary purpose of enabling push protection for secret scanning in a GitHub repository?

To block pushes that contain supported secret patterns before they reach GitHub

To notify repository administrators after a secret has been pushed to the default branch

To remove secrets that were already committed in the repository's history

To automatically rotate any secrets that are detected in the repository

A team uses GitHub Actions for CI/CD. They want to ensure that any pull request that introduces a new dependency with a known critical vulnerability is blocked from merging. Which approach should they use?

Add a step to the existing CI workflow that runs `npm audit` and fails the job if a critical vulnerability is found.

Enable Dependabot alerts and rely on the security team to manually review each pull request.

Require a pull request review from the security team before merging.

Enable code scanning with CodeQL and configure it to detect vulnerable dependencies.

A repository has Dependabot alerts enabled, but the security team is overwhelmed by the number of alerts. They want to prioritize alerts that are actually exploitable in the context of their application. What should they do?

Enable Dependabot security updates for all alerts and merge them automatically.

Use the Dependabot alert metadata, such as CVSS score and exploitability, to triage and prioritize alerts.

Ignore alerts for dependencies that are not directly used in the application.

Disable Dependabot alerts for low-severity vulnerabilities to reduce noise.

A repository uses a package.json file with many npm dependencies. The security team wants to automatically detect known vulnerabilities in these dependencies before they are merged into the main branch. Which approach should they use?

Enable code scanning with the CodeQL analysis and configure it to run on pull requests.

Enable Dependabot version updates and configure them to run on every pull request.

Enable Dependabot alerts and Dependabot security updates for the repository.

Enable GitHub Actions with a dependency scanning workflow that runs on pull_request events and fails if vulnerabilities are found.

GitHubAdvanced Security (GH-500)

Domain 5Objective 5

Shift Left and Strengthen Preventive Security GH-500 Practice Questions (Page 1)

Part of the Security operations: best practices, prioritization, and remediation domain, which accounts for 15-20% of the GH-500 exam.

11questions here

3free pages

3concepts

15-20%of the exam

Questions 1–5

1expert · hard
A team wants to enforce that all pull requests pass both code scanning and secret scanning checks before merging. They have enabled code scanning with CodeQL and push protection for secrets. However, they notice that secret scanning does not appear as a required check in the branch protection rules. What is the likely reason?
Select an answer first
2foundation · easy
What is the primary purpose of enabling push protection for secret scanning in a GitHub repository?
Select an answer first
3application · medium
A team uses GitHub Actions for CI/CD. They want to ensure that any pull request that introduces a new dependency with a known critical vulnerability is blocked from merging. Which approach should they use?
Select an answer first
4expert · hard
A repository has Dependabot alerts enabled, but the security team is overwhelmed by the number of alerts. They want to prioritize alerts that are actually exploitable in the context of their application. What should they do?
Select an answer first
5application · medium
A repository uses a package.json file with many npm dependencies. The security team wants to automatically detect known vulnerabilities in these dependencies before they are merged into the main branch. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.