Understand Vulnerability Context and Remediation Frameworks GH-500 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does a GitHub Security Advisory relate to a Dependabot alert?

   • AA Dependabot alert is generated when a repository dependency matches an affected version range listed in a security advisory
   • BA security advisory is a summary of all Dependabot alerts in an organization
   • CDependabot alerts and security advisories are independent and not linked
   • DA security advisory is generated automatically when a Dependabot alert is created
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team has remediated a Dependabot alert by updating a dependency. The alert closed automatically. Later, a new Dependabot alert appears for the same CVE in a different repository. What should the team do?

   • ADismiss the new alert because the CVE was already fixed.
   • BUpdate the original repository again to ensure the fix is permanent.
   • CTreat the new alert as a separate instance and remediate it in the new repository.
   • DAssume the first fix was ineffective and re-open the original alert.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has two Dependabot alerts to triage. Alert A is for a critical CVE in a library used by an internal tool that only a few employees access. Alert B is for a moderate CVE in a library used by a public-facing API that processes customer data. Both have known exploits. Which alert should be prioritized?

   • AAlert A because the CVE is critical.
   • BBoth alerts should be handled simultaneously because both have known exploits.
   • CNeither alert should be prioritized because both are in third-party libraries.
   • DAlert B because the affected asset is customer-facing and processes sensitive data.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How is the severity of a vulnerability typically represented in a GitHub Security Advisory?

   • AUsing a percentage likelihood of exploitation
   • BUsing a simple color code (red, yellow, green) without a numeric score
   • CUsing a CVSS score and a qualitative rating such as Critical, High, Medium, or Low
   • DUsing a count of affected users
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer receives a GitHub Security Advisory for a vulnerability in a production dependency. The advisory lists affected versions and a patched version. The developer updates the dependency and the Dependabot alert disappears. What should the developer do next to complete the remediation workflow?

   • AVerify the patched version is actually in use and run tests to confirm the fix, then let the alert close automatically.
   • BDelete the dependency from the project to avoid future alerts.
   • CReopen the alert to ensure it is tracked in the security dashboard.
   • DClose the alert manually and move on to the next task.
   Reveal Solution Discussion Select an answer first