Free Exam GH-500: GitHub Advanced Security Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam GH-500: GitHub Advanced Security practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which capability is included in GitHub Code Security for reviewing dependency changes before a pull request is merged?

   1. A. Secret scanning for committed credentials
   2. B. Dependency review for vulnerable versions
   3. C. Push protection for detected credentials
   4. D. Custom patterns for internal secret formats

   Answer: B

   Explanation: GitHub lists "Dependency review: Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request." under GitHub Code Security. The other capabilities belong to secret detection and prevention.

   Reference: About GitHub Advanced Security — GitHub Code Security

2. 2An organization on GitHub Team wants secret scanning for a private repository. Which condition is required for that repository type?

   1. A. Convert the repository to a user-owned repository on GitHub Free.
   2. B. Enable GitHub Code Security without GitHub Secret Protection.
   3. C. Enable GitHub Secret Protection for the private repository.
   4. D. Mark the default branch as protected without enabling Secret Protection.

   Answer: C

   Explanation: The availability statement is: "Organization-owned private and internal repositories: Available with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud." The other changes do not meet the stated product requirement.

   Reference: Secret scanning — How can I access this feature?

3. 3In a repository's dependency graph, what are dependents?

   1. A. Packages whose code is copied into the repository's build output
   2. B. The repositories and packages that rely on this repository
   3. C. Security advisories associated with the repository's dependencies
   4. D. Versions available for packages used by the repository

   Answer: B

   Explanation: GitHub defines "Dependents, the repositories and packages that depend on it". They point toward consumers of the repository, rather than packages the repository consumes or advisories about those packages.

   Reference: Dependency graph — About the dependency graph

4. 4Which SARIF version is supported for uploading third-party static analysis results to GitHub code scanning?

   1. A. 1.0.0
   2. B. 2.0.0
   3. C. 2.1.0
   4. D. 3.0.0

   Answer: C

   Explanation: GitHub describes the supported results as "SARIF 2.1.0". A third-party producer must use that supported version rather than an earlier or hypothetical later version.

   Reference: SARIF support for code scanning — Introduction — supported SARIF version

5. 5When correlating GitHub security findings, how should a CVE identifier be distinguished from a CWE classification?

   1. A. CVE names a weakness class; CWE names the affected package release.
   2. B. CVE identifies a particular vulnerability; CWE classifies a common weakness.
   3. C. CVE measures exploit probability; CWE measures vulnerability severity.
   4. D. CVE and CWE both identify the same specific vulnerability in different databases.

   Answer: B

   Explanation: The CVE rules say a CVE ID and record enable sharing "with confidence that they are referencing the appropriate Vulnerability." NVD states that CWE "was created to identify common software security weaknesses." CVE identifies a specific vulnerability, while CWE classifies a weakness type. They are not interchangeable vulnerability IDs or probability/severity scores.

   Reference: CVE Numbering Authority (CNA) Operational Rules — Introduction — Background

6. 6An organization is rolling out code scanning through a security configuration. Some repositories already run active advanced CodeQL workflows, which should remain in place. Which default setup option is designed for this mixed rollout?

   1. A. Enabled
   2. B. Enabled with advanced setup allowed
   3. C. Disabled
   4. D. Not set

   Answer: B

   Explanation: The guide names "Enabled with advanced setup allowed" and explains: "This setting enables default setup only in repositories where CodeQL analysis is not actively run." It supports both newly enabled repositories and existing active advanced workflows. Plain Enabled does not express that advanced-setup allowance; Disabled and Not set do not enable default setup in uncovered repositories.

   Reference: Creating a custom security configuration — Creating a Secret Protection and Code Security configuration — Default setup note

7. 7What role does the CodeQL CLI serve within GitHub Code Security?

   1. A. It exports organization-wide alert trends as CSV files.
   2. B. It checks whether leaked credentials are still active.
   3. C. It runs CodeQL locally and generates results for upload.
   4. D. It groups outdated dependencies into update pull requests.

   Answer: C

   Explanation: The documentation states: "CodeQL CLI: Run CodeQL processes locally on software projects or to generate code scanning results for upload to GitHub." Its role is local code analysis and result generation, rather than credential validation, dashboard export, or dependency update grouping.

   Reference: About GitHub Advanced Security — GitHub Code Security

8. 8A repository administrator wants to enable Secret Protection through the repository's Settings page. Which sidebar page contains the documented enablement control?

   1. A. Advanced Security
   2. B. Actions
   3. C. Rulesets
   4. D. Secrets and variables

   Answer: A

   Explanation: The enablement procedure instructs the administrator to "click Advanced Security." From that page, the administrator enables Secret Protection and confirms the impact. Actions configures workflows, Rulesets configures repository rules, and Secrets and variables manages stored configuration values; they are not this enablement page.

   Reference: Enabling secret scanning for your repository — Enabling secret scanning alerts for users — repository Settings, Advanced Security

9. 9A build resolves dependencies that are not fully represented in committed manifests or lock files. Which mechanism can add that resolved dependency data to GitHub's dependency graph?

   1. A. Submit the build's resolved dependency snapshot through the dependency submission API.
   2. B. Request a dependency comparison through the dependency review API.
   3. C. Export the current dependency graph through the repository SBOM endpoint.
   4. D. Select Refresh Dependabot alerts to rescan the repository's declared dependencies.

   Answer: A

   Explanation: The graph includes "any dependencies that are submitted for the repository using the dependency submission API." Submit the build-resolved snapshot to add the missing information. Review compares dependency state and SBOM export reads it; neither supplies the build snapshot. The refresh guide confirms: "Clicking Refresh Dependabot alerts will only scan manifest files."

   Reference: Dependency graph — About the dependency graph

10. 10A repository needs an existing third-party static analyzer instead of CodeQL. How can its findings be presented as GitHub code scanning alerts?

    1. A. Run the analyzer and retain its findings only as a workflow artifact.
    2. B. Produce compatible SARIF findings and upload them to code scanning.
    3. C. Run the analyzer in an action and use only its exit code as the finding report.
    4. D. Post the analyzer's findings as pull request comments instead of uploading results.

    Answer: B

    Explanation: GitHub states: "Code scanning is interoperable with third-party code scanning tools that output Static Analysis Results Interchange Format (SARIF) data." Compatible findings must be uploaded into code scanning. Artifact retention, a process exit code, and pull request comments can communicate results elsewhere but do not ingest those findings as code scanning alerts.

    Reference: Code scanning — About third-party code scanning tools