GitHub Advanced Security v1.0
Question 1
By default, what is the minimum role needed to bypass push protection in a repository?
- A. Maintain
- B. Admin
- C. Triage
- D. Write
Answer : D
Question 2
By default, who will receive an e-mail when a secret has been detected in a repository? Each answer presents a complete solution. (Choose two.)
- A. users with the Maintain repository role
- B. user who committed the secret
- C. users with the Write repository role
- D. users with the Admin repository role
- E. security analyst
Answer : BD
Question 3
Which of the following is the most proactive and practical way to prevent new secret scanning alerts?
- A. Scan for non-provider patterns
- B. Use feature branches
- C. Configure a secret scanning Actions workflow.
- D. Enable push protection.
Answer : D
Question 4
By default, where will secret scanning look in a repository in order to execute its job? Each correct answer presents part of the solution. (Choose three.)
- A. all files in the repository
- B. dependencies
- C. selected files in the repository
- D. full commit history
- E. all branches
Answer : CDE
Question 5
Which of the following would raise secret scanning alerts?
- A. GitHub personal access token
- B. server-side request forgery
- C. cross site scripting (XSS)
- D. structured query language (SQL) injection
Answer : A
Question 6
What is the purpose of push protection?
- A. to scan and block the code that contains vulnerabilities before it reaches the repository
- B. to validate the push by the code owner
- C. to define license requirements for the repository
- D. to scan and block the code that contains secrets before it reaches the repository
Answer : D
Question 7
Which of the following pre-defined roles is required to manage code scanning alerts in a repository?
- A. Maintain
- B. View
- C. Read
- D. Triage
Answer : C
Question 8
Where is secret scanning enabled on a private repository?
- A. within a secret.yml file in the repository
- B. in the code scanning default set up settings
- C. within a repository ruleset
- D. in the code security settings
Answer : D
Question 9
HOTSPOT
-
You have a GitHub Enterprise Server instance named Server1 that contains multiple organizations. Server1 uses GitHub Advanced Security and has GitHub Secret Protection enabled. Repository administrators can change the secret scanning settings of their respective repository.
You discover the following issues:
• The developers at your company bypass secret scanning push protection by asking the repository administrators to temporarily disable secret scanning.
• Some security-critical secret scanning alerts are dismissed by non-security staff without review.
You need to configure enterprise governance to meet the following requirements:
• Ensure that the repository administrators can no longer manage or modify secret scanning.
• Ensure that dismissing secret scanning alerts requires the approval of designated users.
What should you do for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer : 
Question 10
You have a GitHub repository named Repo1 that runs CodeQL code scanning. Repo1 contains both Java and Kotlin source code. Repo1 generates additional source files during compilation.
Recent alerts indicate that Kotlin files cannot be processed without a build.
You need to ensure that CodeQL analyzes both the Java files and the Kotlin files and includes the generated source files in the CodeQL database.
What should you do?
- A. Set the CodeQL build mode to none.
- B. Set the CodeQL build mode to autobuild.
- C. Set the CodeQL build mode to manual.
- D. Add Kotlin to the CodeQL languages list.
Answer : D
Question 11
You have a GitHub Enterprise Cloud Organization.
You enable secret scanning alerts and secret scanning push protection across all repositories.
You review the alerts by using the Overview dashboard of security overview in the GitHub interface.
You need to identify only the secret scanning alerts that were generated when push protection was bypassed.
Which filter should you use?
- A. push_protection:true
- B. secret-scanning-push_protection.bypassed:true
- C. push_protection.bypassed:true
- D. bypassed.secret-scanning:true
Answer : B
Question 12
You have a GitHub Enterprise Cloud Organization that contains a private repository named Repo1 and has GitHub Secret Protection enabled. Repo1 contains a workflow that writes an access key ID to config.txt and a secret access key to secrets.txt. Repo1 has secret scanning push protection enabled.
You discover that a developer at your company was able to push changes that contain both the access key ID and the secret access key without the push being blocked.
What is the cause of the issue?
- A. The developer performed the push from the command line.
- B. The push did NOT include a merge into the default branch.
- C. The push was performed on a private repository.
- D. The secrets were stored in separate files.
Answer : D
Question 13
Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?
- A. CodeQL analyzes the code and raises vulnerabilities in third-party dependencies.
- B. Dependabot reviews manifest files in the repository.
- C. The build tool finds the vulnerable dependencies and calls the Dependabot API.
- D. A dependency graph is created, and Dependabot compares the graph to the GitHub Advisory database.
Answer : D
Question 14
In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
- A. read-only access to all the repository’s files
- B. dependency graph enabled at the organization level for all new private repositories
- C. write access to the dependency manifest and lock files for an enterprise
- D. read-only access to the dependency manifest and lock files for a repository
Answer : BD
Question 15
You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?
- A. when you merge a pull request that contains a security update
- B. when Dependabot creates a pull request to update dependencies
- C. when you dismiss the Dependabot alert
- D. when the pull request checks are successful
Answer : A