Understand and Manage Dependency and Supply Chain Risks GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer is reviewing the dependency graph for a Ruby on Rails application and sees that the 'nokogiri' gem is listed as a direct dependency. However, the developer knows they removed nokogiri from the Gemfile last week. Why does it still appear in the dependency graph?

   • AThe Gemfile.lock still contains nokogiri as a transitive dependency of another gem.
   • BThe dependency graph is cached and only updates when a Dependabot alert is triggered.
   • CThe dependency graph only shows the latest commit, and the removal was not pushed to the default branch.
   • DThe dependency graph is showing a false positive because nokogiri is a system dependency.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following are valid SBOM export formats supported by GitHub?

   • ASPDX and CycloneDX
   • BCSV and PDF
   • CYAML and TOML
   • DJSON and XML
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A compliance officer asks for an SBOM of a .NET application to verify that no GPL-licensed libraries are used in production. The officer prefers a format that is human-readable and can be easily reviewed in a text editor. Which SBOM format should you export?

   • ASPDX in tag-value format
   • BSPDX in JSON format
   • CCycloneDX in JSON format
   • DCycloneDX in XML format
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is adopting a 'shift-left' security approach and wants to identify supply chain risks as early as possible in the development lifecycle. They currently rely on Dependabot alerts, which only fire after a vulnerability is published. They want to proactively assess the risk of new dependencies before they are added to the codebase. What should they implement?

   • AConfigure Dependabot alerts to run on every pull request instead of only on the default branch.
   • BImplement a CI/CD pipeline that generates an SBOM for each pull request and scans it for vulnerabilities before merging.
   • CEnable the dependency graph and review it manually before merging any pull request that adds a new dependency.
   • DUse Dependabot version updates to automatically update dependencies to the latest versions, reducing the risk of known vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to understand the full supply chain risk of a repository by identifying not only known vulnerabilities but also the licenses of all dependencies. They plan to use this information to enforce a policy that prohibits copyleft licenses. What should they use?

   • ADependabot alerts, which provide vulnerability information and license details for every dependency.
   • BThe security overview page, which aggregates vulnerability and license data across the organization.
   • CThe dependency graph alone, which shows vulnerabilities and licenses for all direct and transitive dependencies.
   • DAn SBOM export, which lists all dependencies with their licenses, combined with Dependabot alerts for vulnerabilities.
   Reveal Solution Discussion Select an answer first