A security team is evaluating their organization's security posture. They have enabled code scanning, secret scanning, and Dependabot alerts across all repositories. They want to identify which repositories are at the highest risk and prioritize remediation efforts. They also need to track whether their security posture is improving over time. Which approach should they take?

Enable custom policies to enforce security features

Export all alerts to a CSV and analyze in a spreadsheet

Review each repository's Security tab individually

Use Security Overview to view risk assessment and trend analysis across all repositories

A maintainer of a public repository wants to enable push protection for secrets. What is required to enable this feature?

Contact GitHub support to enable it

Enable push protection in the repository's security settings

It is automatically enabled for all public repositories

How does Security Overview help organizations improve their security posture?

By automatically fixing vulnerabilities

By generating security reports for compliance

By providing a centralized view of all security alerts and risks

A developer accidentally committed a GitHub personal access token to a private repository. The token is now visible in the commit history. What should the security team do first?

Ignore the alert because it's a private repository

Revoke the token and then remove it from the repository history

Remove the token from the repository history only

Enable push protection to prevent future pushes

An enterprise security team wants to enforce that all new repositories automatically enable code scanning and secret scanning. They also want to see a consolidated view of security alerts across all organizations in the enterprise. Which two features should they use together?

Security Overview and secret scanning alerts

Organization settings and Dependabot alerts

Enterprise custom policies and Security Overview

Repository templates and code scanning alerts

GitHubAdvanced Security (GH-500)

Domain 1Objective 1

Understand GitHub Security Suites and Architecture GH-500 Practice Questions (Page 3)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

35questions here

7free pages

10concepts

15-20%of the exam

10 Concepts in This Objective

GitHub Security suite structure
Navigation of security features
Code Security features
Secret Protection features
Supply Chain Security features
Contrasting security suites
Public repository security features
Enterprise security features
Security Overview features
Benefits of Security Overview

Questions 11–15

11expert · hard
A security team is evaluating their organization's security posture. They have enabled code scanning, secret scanning, and Dependabot alerts across all repositories. They want to identify which repositories are at the highest risk and prioritize remediation efforts. They also need to track whether their security posture is improving over time. Which approach should they take?
Select an answer first
12application · medium
A maintainer of a public repository wants to enable push protection for secrets. What is required to enable this feature?
Select an answer first
13foundation · easy
How does Security Overview help organizations improve their security posture?
Select an answer first
14application · medium
A developer accidentally committed a GitHub personal access token to a private repository. The token is now visible in the commit history. What should the security team do first?
Select an answer first
15application · medium
An enterprise security team wants to enforce that all new repositories automatically enable code scanning and secret scanning. They also want to see a consolidated view of security alerts across all organizations in the enterprise. Which two features should they use together?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.