GH-500Preview

What happens when you enable secret scanning on a private repository?

You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)

Which of the following tasks can be performed by a security team as a proactive measure to help address secret scanning alerts? Each answer presents a complete solution. (Choose two.)

Which of the following statements most accurately describes push protection for secret scanning custom patterns?

Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?

What role is required to change a repository’s code scanning severity threshold that fails a pull request status check?

By default, where will secret scanning look in a repository in order to execute its job? Each correct answer presents part of the solution. (Choose three.)

Which of the following pre-defined roles is required to manage code scanning alerts in a repository?

Where can you find a deleted line of code that contained a secret value?

Assuming that default security and analysis settings have not been changed at the repository, organization, or enterprise level, which scenario would generate a dependency graph for the repository?

What is the minimum role needed in order to view the secret scanning alerts list within the Security tab of a repository?

As a developer with write access, you navigate to a code scanning alert in your repository. When will GitHub close this alert?

Which of the following formats are used to describe a Dependabot alert? Each answer presents a complete solution. (Choose two.)

Where can a user change a repository’s code scanning severity threshold that fails a pull request status check?

What is the first step you should take to fix an alert in secret scanning?

What scenario demonstrates the use of Dependabot security updates?

When secret scanning detects a set of credentials on a public repository, what does GitHub do?

Which of the following options are code scanning application programming interface (API) endpoints? Each answer presents part of the solution. (Choose two.)

What is a benefit of using a custom CodeQL configuration file?

If default code security settings have not been changed at the repository, organization, or enterprise level, which repositories receive Dependabot alerts?

By default, what is the minimum role needed to bypass push protection in a repository?

In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)

Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabled? (Each answer presents part of the solution. Choose two.)

If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?