A security team is managing a large number of Dependabot alerts. They want to ensure that all alerts are triaged and remediated in a timely manner. What is the most effective approach?

Assign all alerts to a single security engineer to ensure consistency.

Establish a triage process that prioritizes alerts based on severity, exploitability, and asset criticality, and assign them to the appropriate teams.

Use GitHub's auto-triage features to automatically dismiss low-severity alerts.

Focus only on critical alerts and ignore moderate and low ones.

Which CWE category would likely be assigned to a vulnerability caused by insufficient input validation leading to SQL injection?

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

What is the primary purpose of CWE (Common Weakness Enumeration)?

To assign unique identifiers to specific instances of vulnerabilities

To provide a scoring system for the severity of vulnerabilities

To provide a standardized taxonomy of software and hardware weakness types

To list all known exploits for a given vulnerability

Which component is typically included in a GitHub Security Advisory?

A list of all users who have downloaded the vulnerable package

The full source code of the vulnerable component

The exact exploit code to reproduce the vulnerability

Affected versions and patched versions

A developer sees a code scanning alert for a vulnerability that is also covered by a GitHub Security Advisory. The advisory recommends updating a dependency, but the code scanning alert points to a specific line of code. What should the developer do?

Update the dependency as recommended by the advisory.

Fix the code at the flagged line, ignoring the advisory.

Review both the advisory and the code scanning alert to determine the appropriate fix.

Dismiss the code scanning alert because the advisory already covers the vulnerability.

GitHubAdvanced Security (GH-500)

Domain 5Objective 1

Understand Vulnerability Context and Remediation Frameworks GH-500 Practice Questions (Page 4)

Part of the Security operations: best practices, prioritization, and remediation domain, which accounts for 15-20% of the GH-500 exam.

27questions here

6free pages

8concepts

15-20%of the exam

Questions 16–20

16expert · hard
A security team is managing a large number of Dependabot alerts. They want to ensure that all alerts are triaged and remediated in a timely manner. What is the most effective approach?
Select an answer first
17foundation · easy
Which CWE category would likely be assigned to a vulnerability caused by insufficient input validation leading to SQL injection?
Select an answer first
18foundation · easy
What is the primary purpose of CWE (Common Weakness Enumeration)?
Select an answer first
19foundation · easy
Which component is typically included in a GitHub Security Advisory?
Select an answer first
20application · medium
A developer sees a code scanning alert for a vulnerability that is also covered by a GitHub Security Advisory. The advisory recommends updating a dependency, but the code scanning alert points to a specific line of code. What should the developer do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.