GH-500 Exam Dumps Pass with Updated 2026 Certified Exam Questions
GH-500 Exam Questions - Real & Updated Questions PDF
NEW QUESTION # 24
After investigating a code scanning alert related to injection, you determine that the input is properly sanitized using custom logic. What should be your next step?
- A. Open an issue in the CodeQL repository.
- B. Draft a pull request to update the open-source query.
- C. Ignore the alert.
- D. Dismiss the alert with the reason "false positive."
Answer: D
Explanation:
When you identify that a code scanning alert is a false positive-such as when your code uses a custom sanitization method not recognized by the analysis-you should dismiss the alert with the reason "false positive." This action helps improve the accuracy of future analyses and maintains the relevance of your security alerts.
As per GitHub's documentation:
"If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the CodeQL repository and improving the analysis." By dismissing the alert appropriately, you ensure that your codebase's security alerts remain actionable and relevant.
NEW QUESTION # 25
In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?
- A. Add Dependabot rules.
- B. Enable Dependabot security updates.
- C. Enable Dependabot alerts.
- D. Add a workflow with the dependency review action.
Answer: D
Explanation:
To detect and block vulnerable dependencies before merge, developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.
This is a preventative measure during development, unlike Dependabot, which reacts after the fact.
NEW QUESTION # 26
When secret scanning detects a set of credentials on a public repository, what does GitHub do?
- A. It notifies the service provider who issued the secret.
- B. It displays a public alert in the Security tab of the repository.
- C. It scans the contents of the commits for additional secrets.
- D. It sends a notification to repository members.
Answer: A
Explanation:
When a public repository contains credentials that match known secret formats, GitHub will automatically notify the service provider that issued the secret. This process is known as "secret scanning partner notification". The provider may then revoke the secret or contact the user directly.
GitHub does not publicly display the alert and does not send internal repository notifications for public detections.
NEW QUESTION # 27
What is a prerequisite to define a custom pattern for a repository?
- A. Change the repository visibility to Internal
- B. Close other secret scanning alerts
- C. Enable secret scanning
- D. Specify additional match criteria
Answer: C
Explanation:
You must enable secret scanning before defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.
Without enabling secret scanning, GitHub will not process or apply custom patterns.
NEW QUESTION # 28
A dependency has a known vulnerability. What does the warning message include?
- A. The security impact of these changes
- B. How many projects use these components
- C. A brief description of the vulnerability
- D. An easily understandable visualization of dependency change
Answer: C
Explanation:
When a vulnerability is detected, GitHub shows a warning that includes a brief description of the vulnerability. This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.
This helps developers understand the context and urgency of the vulnerability before applying the fix.
NEW QUESTION # 29
Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:
- A. Public repositories
- B. User-owned private repositories
- C. All new repositories within your organization
- D. Private repositories
Answer: A
Explanation:
By default, secret scanning is enabled automatically for all public repositories. For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.
This default behavior helps protect open-source projects without requiring additional configuration.
NEW QUESTION # 30
What role is required to change a repository's code scanning severity threshold that fails a pull request status check?
- A. Write
- B. Maintain
- C. Triage
- D. Admin
Answer: D
Explanation:
To change the threshold that defines whether a pull request fails due to code scanning alerts (such as blocking merges based on severity), the user must have Admin access on the repository. This is because modifying these settings falls under repository configuration privileges.
Users with Write, Maintain, or Triage roles do not have the required access to modify rulesets or status check policies.
NEW QUESTION # 31
Which of the following is the best way to prevent developers from adding secrets to the repository?
- A. Configure a security manager
- B. Enable push protection
- C. Create a CODEOWNERS file
- D. Make the repository public
Answer: B
Explanation:
The best proactive control is push protection. It scans for secrets during a git push and blocks the commit before it enters the repository.
Other options (like CODEOWNERS or security managers) help with oversight but do not prevent secret leaks.
Making a repo public would increase the risk, not reduce it.
NEW QUESTION # 32
Which of the following formats are used to describe a Dependabot alert? (Each answer presents a complete solution. Choose two.)
- A. Common Weakness Enumeration (CWE)
- B. Common Vulnerabilities and Exposures (CVE)
- C. Exploit Prediction Scoring System (EPSS)
- D. Vulnerability Exploitability exchange (VEX)
Answer: A,B
Explanation:
Dependabot alerts utilize standardized identifiers to describe vulnerabilities:
CVE (Common Vulnerabilities and Exposures): A widely recognized identifier for publicly known cybersecurity vulnerabilities.
CWE (Common Weakness Enumeration): A category system for software weaknesses and vulnerabilities.
These identifiers help developers understand the nature of the vulnerabilities and facilitate the search for more information or remediation strategies.
NEW QUESTION # 33
As a repository owner, you do not want to run a GitHub Actions workflow when changes are made to any .txt or markdown files. How would you adjust the event trigger for a pull request that targets the main branch? (Each answer presents part of the solution. Choose three.) on:
pull_request:
branches: [main]
- A. - '/*.txt'
- B. paths-ignore:
- C. - 'docs/*.md'
- D. paths:
- E. - '/*.md'
Answer: A,B,E
Explanation:
To exclude .txt and .md files from triggering workflows on pull requests to the main branch:
on: defines the event (e.g., pull_request)
pull_request: is the trigger
paths-ignore: is the key used to ignore file patterns
Example YAML:
yaml
CopyEdit
on:
pull_request:
branches:
- main
paths-ignore:
- '*.md'
- '*.txt'
Using paths: would include only specific files instead - not exclude. paths-ignore: is correct here.
NEW QUESTION # 34
Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?
- A. Enable all in existing repositories
- B. Enable by default for new public repositories
- C. Enable all for Dependabot alerts
- D. Enable all for Dependency graph
Answer: C
Explanation:
To ensure you're notified whenever a vulnerability is detected via Dependabot, you must enable alerts for Dependabot in your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.
The dependency graph must be enabled for scanning, but does not send alerts itself.
NEW QUESTION # 35
If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?
- A. Users with Write permissions to the repository
- B. Users with Admin privileges to the repository
- C. Users with Read permissions to the repository
- D. Users with Maintain privileges to the repository
Answer: A
Explanation:
By default, users with Write, Maintain, or Admin permissions will receive notifications for new Dependabot alerts. However, Write permission is the minimum level needed to be automatically notified. Users with only Read access do not receive alerts unless added explicitly.
NEW QUESTION # 36
What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?
- A. Sort to display the oldest first
- B. Select only the custom patterns
- C. Filter to display active secrets
- D. Sort to display the newest first
Answer: C
Explanation:
The best way to prioritize secret scanning alerts is to filter by active secrets - these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.
Sorting by time or filtering by custom patterns won't help with risk prioritization directly.
NEW QUESTION # 37
What are Dependabot security updates?
- A. Compatibility scores to let you know whether updating a dependency could cause breaking changes to your project
- B. Automated pull requests that help you update dependencies that have known vulnerabilities
- C. Automated pull requests to update the manifest to the latest version of the dependency
- D. Automated pull requests that keep your dependencies updated, even when they don't have any vulnerabilities
Answer: B
Explanation:
Dependabot security updates are automated pull requests triggered when GitHub detects a vulnerability in a dependency listed in your manifest or lockfile. These PRs upgrade the dependency to the minimum safe version that fixes the vulnerability.
This is separate from regular updates (which keep versions current even if not vulnerable).
NEW QUESTION # 38
Where can you view code scanning results from CodeQL analysis?
- A. At Security advisories
- B. The repository's code scanning alerts
- C. A CodeQL database
- D. A CodeQL query pack
Answer: B
Explanation:
All results from CodeQL analysis appear under the repository's code scanning alerts tab. This section is part of the Security tab and provides a list of all current, fixed, and dismissed alerts found by CodeQL.
A CodeQL database is used internally during scanning but does not display results. Query packs contain rules, not results. Security advisories are for published vulnerabilities, not per-repo findings.
NEW QUESTION # 39
You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?
- A. When you merge a pull request that contains a security update
- B. When you dismiss the Dependabot alert
- C. When Dependabot creates a pull request to update dependencies
- D. When the pull request checks are successful
Answer: A
Explanation:
A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.
Simply generating a PR or passing checks does not change the alert status; merging is the key step.
NEW QUESTION # 40
What is a security policy?
- A. A file in a GitHub repository that provides instructions to users about how to report a security vulnerability
- B. An alert about dependencies that are known to contain security vulnerabilities
- C. A security alert issued to a community in response to a vulnerability
- D. An automatic detection of security vulnerabilities and coding errors in new or modified code
Answer: A
Explanation:
A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project's transparency and ensures timely communication and mitigation of any reported issues.
Adding this file also enables a "Report a vulnerability" button in the repository's Security tab.
NEW QUESTION # 41
What is the purpose of the SECURITY.md file in a GitHub repository?
- A. contributing.md
- B. readme.md
- C. support.md
- D. security.md
Answer: D
Explanation:
The correct place to look is the SECURITY.md file. This file provides contributors and security researchers with instructions on how to responsibly report vulnerabilities. It may include contact methods, preferred communication channels (e.g., security team email), and disclosure guidelines.
This file is considered a GitHub best practice and, when present, activates a "Report a vulnerability" button in the repository's Security tab.
NEW QUESTION # 42
Which of the following secret scanning features can verify whether a secret is still active?
- A. Validity checks
- B. Branch protection
- C. Push protection
- D. Custom patterns
Answer: A
Explanation:
Validity checks, also called secret validation, allow GitHub to check if a detected secret is still active. If verified as live, the alert is marked as "valid", allowing security teams to prioritize the most critical leaks.
Push protection blocks secrets but does not check their validity. Custom patterns are user-defined and do not include live checks.
NEW QUESTION # 43
......
Microsoft GH-500 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Pass Guaranteed Quiz 2026 Realistic Verified Free Microsoft: https://actualtests.passsureexam.com/GH-500-pass4sure-exam-dumps.html