Understand Vulnerability Context and Remediation Frameworks GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team must prioritize two vulnerabilities. Vulnerability X is a critical CVE in a library used by an internal HR system that is only accessible via VPN. Vulnerability Y is a high CVE in a library used by a public marketing website that has no sensitive data. Both have known exploits. The team has resources to fix only one this week. Which should they fix first?

   • AVulnerability X because it has a higher CVSS score.
   • BVulnerability X because the HR system contains sensitive data, even though it is less exposed.
   • CNeither, because both are in third-party libraries and can be patched later.
   • DVulnerability Y because the public website has a larger attack surface.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How can you verify that a remediation for a vulnerability is effective?

   • ABy confirming that the vulnerability is no longer mentioned in the news
   • BBy re-running the security scan or checking that the alert is no longer triggered
   • CBy waiting for the next scheduled scan
   • DBy deleting the alert from the repository
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does tracking the lifecycle of an alert involve?

   • AAutomatically closing all alerts after a certain period
   • BAssigning a unique number to each alert
   • CRecording the alert in a spreadsheet for future reference
   • DMonitoring the alert from creation through triage, remediation, and closure
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After a developer applies a fix for a code scanning alert, the alert remains open in the GitHub Security tab. What is the most likely reason, and what should the developer do?

   • AThe fix was not pushed to the default branch; push the changes and wait for the next scan.
   • BThe alert is a false positive and should be dismissed.
   • CThe developer must manually close the alert after fixing the code.
   • DThe alert will close after 30 days automatically.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Dependabot alert is raised for a vulnerability in a Python package. The package has a patched version, but updating it requires a major version bump that may break the application. What is the best course of action?

   • AApply the update in a test environment and run the full test suite before deploying.
   • BDismiss the alert because the update is too risky.
   • CUpdate the package directly in production to save time.
   • DPin the package to the current version and ignore future alerts.
   Reveal Solution Discussion Select an answer first