Understand and Manage Dependency and Supply Chain Risks GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is required to provide an SBOM for a product that is distributed as a container image. The SBOM must include the dependencies of the application inside the container, as well as the base image components. What is the most effective way to generate this SBOM?

   • AExport an SBOM from the application repository using GitHub's dependency graph, which automatically includes base image components.
   • BExport an SBOM from the application repository and manually add the base image components to the file.
   • CUse a container-specific SBOM tool, such as Syft or Trivy, to scan the container image and generate an SBOM that includes both application and base image dependencies.
   • DUse the GitHub API to fetch the dependency graph for the container image repository.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following information can you obtain from the dependency graph for a repository?

   • AKnown vulnerabilities in the dependencies
   • BThe exact commit history of each dependency
   • CThe license of the repository itself
   • DThe performance impact of each dependency
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which GitHub Advanced Security feature automatically monitors a repository's dependencies and alerts you when a known vulnerability is detected in a direct or transitive dependency?

   • ACode scanning
   • BSecret scanning
   • CDependabot alerts
   • DDependency review
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security auditor requires a machine-readable inventory of all direct and transitive dependencies in a Python repository, including license information, to review for compliance. The auditor specifically requests a format that is widely supported by their tooling. What should you do?

   • AGenerate a requirements.txt file with pip freeze and share it with the auditor.
   • BUse the GitHub API to fetch the dependency graph and convert it to JSON manually.
   • CDownload the dependency graph as a CSV file from the repository settings.
   • DExport the dependency graph as a Software Bill of Materials (SBOM) in SPDX format from the repository's Insights tab.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is evaluating whether to use SPDX or CycloneDX for their SBOM exports. They need a format that supports the inclusion of vulnerability information directly in the SBOM, so they can share a single file that contains both the dependency list and known vulnerabilities. Which format should they choose?

   • ACycloneDX, because it is the only format that includes license information.
   • BSPDX, because it natively supports vulnerability data through the 'vulnerability' field.
   • CSPDX, because it is the only format that can be exported from GitHub.
   • DCycloneDX, because it natively supports vulnerability data through the 'vulnerabilities' field.
   Reveal Solution Discussion Select an answer first