Shift Left and Strengthen Preventive Security GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When a developer attempts to push a commit containing a detected secret and push protection is enabled, what is the immediate outcome?

   • AThe push succeeds but an alert is sent to the security team
   • BThe push is queued until a repository administrator approves it
   • CThe push succeeds and the secret is automatically redacted in the repository
   • DThe push is rejected and the developer is shown the location of the secret
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the main benefit of enabling code scanning to run on pull requests?

   • AIt automatically assigns a security reviewer to every pull request
   • BIt blocks all pull requests from being merged unless the repository is public
   • CIt prevents the pull request from being merged if any test fails
   • DIt detects security vulnerabilities and code errors in the proposed changes before they are merged
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does GitHub's dependency scanning primarily do for a repository?

   • AIt automatically upgrades all dependencies to their latest major versions
   • BIt identifies known vulnerabilities in the project's dependencies and generates alerts
   • CIt monitors the runtime behavior of the application to detect exploited dependencies
   • DIt scans the source code for hardcoded credentials and API keys
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Dependabot alert indicates that a project dependency has a critical vulnerability. What is the recommended first action for a developer to take?

   • ARe-run the dependency scan to confirm the alert is a false positive
   • BReview the alert details and apply the suggested fix, typically by updating to a patched version
   • CDelete the dependency from the project immediately
   • DIgnore the alert if the project is not in production
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A team has enabled code scanning with CodeQL and push protection for secrets. However, they are seeing a high number of false positives from CodeQL, and developers are starting to ignore alerts. The security team wants to reduce alert fatigue while still catching real vulnerabilities. What should they do?

   • ADisable CodeQL for less critical repositories and keep it only for production code.
   • BAdjust the CodeQL query suite to focus on high-severity and security-relevant queries, and require the check to pass before merging.
   • CTurn off CodeQL alerts and rely solely on manual code reviews.
   • DIncrease the number of CodeQL queries to catch more vulnerabilities, even if it increases false positives.
   Reveal Solution Discussion Select an answer first