GH-500 Certification – Valid Exam Dumps Questions Study Guide! (Updated 139 Questions)
GH-500 Dumps are Available for Instant Access using ActualPDF
Microsoft GH-500 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 25
Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?
- A. A repository member of an enterprise organization
- B. An enterprise administrator
- C. A user who has read access to the repository
- D. A user who has write access to the repository
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
By default, users with write access to a repository have the ability to merge pull requests, including those created by Dependabot for security updates. This access level allows contributors to manage and integrate changes, ensuring that vulnerabilities are addressed promptly.
Users with only read access cannot merge pull requests, and enterprise administrators do not automatically have merge rights unless they have write or higher permissions on the specific repository.
NEW QUESTION # 26
Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?
- A. Enable all for Dependabot alerts
- B. Enable all in existing repositories
- C. Enable all for Dependency graph
- D. Enable by default for new public repositories
Answer: A
Explanation:
To ensure you're notified whenever a vulnerability is detected via Dependabot, you must enable alerts for Dependabot in your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.
The dependency graph must be enabled for scanning, but does not send alerts itself.
NEW QUESTION # 27
What is a prerequisite to define a custom pattern for a repository?
- A. Close other secret scanning alerts.
- B. Enable secret scanning.
- C. Specify additional match criteria.
- D. Change the repository visibility to Internal.
Answer: B
Explanation:
Defining a custom pattern for a repository
Before defining a custom pattern, you must ensure that Secret Protection is enabled on your repository.
Note: Enabling secret scanning for your repository
You can configure how GitHub scans your repositories for leaked secrets and generates alerts About enabling secret scanning alerts for users Secret scanning alerts for users can be enabled on any free public repository that you own.
Secret scanning alerts for users can be enabled for any repository that is owned by an organization.
NEW QUESTION # 28
As a developer with write access, you navigate to a code scanning alert in your repository. When will GitHub close this alert?
- A. after you triage the pull request containing the alert
- B. after you fix the code by committing within the pull request
- C. after you find the code and click the alert within the pull request
- D. when you use data-flow analysis to find potential security issues in code
Answer: C
Explanation:
GitHub automatically closes a code scanning alert when the vulnerable code is fixed in the same branch where the alert was generated, usually via a commit inside a pull request. Simply clicking or triaging an alert does not resolve it. The alert is re-evaluated after each push to the branch, and if the issue no longer exists, it is marked as resolved.
NEW QUESTION # 29
Secret scanning will ignore a secret_scanning.yml file that
- A. is 1 MB or larger
- B. has 1,000 or more directories
- C. is 100 KB or larger.
- D. contains 1,000 or more entries.
Answer: A
Explanation:
Excluding folders and files from secret scanning
You can customize secret scanning to automatically close alerts for secrets found in specific directories or files by configuring a secret_scanning.yml file in your repository.
* If there are more than 1,000 entries in paths-ignore, secret scanning will only exclude the first
1,000 directories from scans.
* If secret_scanning.yml is larger than 1 MB, secret scanning will ignore the entire file.
NEW QUESTION # 30
Which two pieces of information should be included in a security advisory?
- A. Product affected and severity.
- B. Exposures list and administrator name.
- C. Administrator name and severity.
- D. Severity and exposure list.
Answer: A
NEW QUESTION # 31
Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?
- A. Push protection
- B. Custom pattern dry runs
- C. Secret validation
- D. Non-provider patterns
Answer: C
Explanation:
Secret validation checks whether a secret found in your repository is still valid and active with the issuing provider (e.g., AWS, GitHub, Stripe). If a secret is confirmed to be active, the alert is marked as verified, which means it's considered a high-priority issue because it presents an immediate security risk.
This helps teams respond faster to valid, exploitable secrets rather than wasting time on expired or fake tokens.
NEW QUESTION # 32
If default code security settings have not been changed at the repository, organization, or enterprise level, which repositories receive Dependabot alerts?
- A. repositories owned by an enterprise account
- B. repositories owned by an organization
- C. private repositories
- D. none
Answer: D
Explanation:
When Dependabot detects vulnerable dependencies in your repositories, we generate a Dependabot alert and display it on the Security tab for the repository. GitHub notifies the maintainers of affected repositories about the new alert according to their notification preferences.
Dependabot is enabled by default on all public repositories, and needs to be enabled on private repositories.
Note:
By default, no repositories receive Dependabot alerts unless configuration is explicitly enabled.
GitHub does not enable Dependabot alerts automatically for any repositories unless:
The feature is turned on manually
It's configured at the organization or enterprise level via security policies This includes public, private, and enterprise-owned repositories -manual activation is required.
NEW QUESTION # 33
What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?
- A. Select only the custom patterns.
- B. Sort to display the oldest first.
- C. Filter to display active secrets.
- D. Sort to display the newest first.
Answer: C
Explanation:
The best way to prioritize secret scanning alerts is to filter by active secrets --- these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.
NEW QUESTION # 34
Which key is required in the update settings of the Dependabot configuration file?
- A. assignees
- B. rebase-strategy
- C. package-ecosystem
- D. commit-message
Answer: C
Explanation:
Enabling Dependabot version updates
You enable Dependabot version updates by committing a dependabot.yml configuration file to your repository. If you enable the feature in your settings page, GitHub creates a basic file which you can edit, otherwise you can create the file using any file editor.
1. On GitHub, navigate to the main page of the repository.
[Steps omitted. See step 8 below]
...
7. Add an updates section, with an entry for each package manager you want Dependabot to monitor. This key is mandatory. You use it to configure how Dependabot updates the versions or your project's dependencies. Each entry configures the update settings for a particular package manager.
8. For each package manager, use:
*-> package-ecosystem to specify the package manager.
directories or directory to specify the location of multiple manifest or other definition files.
chedule.interval to specify how often to check for new versions.
9. Check the dependabot.yml configuration file in to the .github directory of the repository.
NEW QUESTION # 35
Which of the following steps should you follow to integrate CodeQL into a third-party continuous integration system? Each answer presents part of the solution. (Choose three.)
- A. upload scan results
- B. write queries
- C. process alerts
- D. analyze code
- E. install the CLI
Answer: A,D,E
Explanation:
Using code scanning with your existing CI system
You can analyze your code with the CodeQL CLI or another tool in a third-party continuous integration system and upload the results to GitHub. The resulting code scanning alerts are shown alongside any alerts generated within GitHub.
[A] Setting up your analysis tool
You will first need to download your analysis tool of choice and set it up with your CI system.
If you are using the CodeQL CLI, you need to make the full contents of the CodeQL CLI bundle available to every CI server that you want to run CodeQL code scanning analysis on.
[B ] Analyzing code
To analyze code with the CodeQL CLI or another analysis tool, you will want to check out the code you want to analyze and set up the codebase environment, making sure that any dependencies are available. You may also want to find the build command for the codebase, typically available in your CI system's configuration file.
You can then complete the steps to analyze your codebase and produce results, which will differ based on the static analysis tool you are using.
[E] Uploading your results to GitHub
Once you have analyzed your code, produced SARIF results, and ensured you can authenticate with GitHub, you can upload the results to GitHub.
NEW QUESTION # 36
What are Dependabot security updates?
- A. Automated pull requests that keep your dependencies updated, even when they don't have any vulnerabilities
- B. Automated pull requests to update the manifest to the latest version of the dependency
- C. Automated pull requests that help you update dependencies that have known vulnerabilities
- D. Compatibility scores to let you know whether updating a dependency could cause breaking changes to your project
Answer: C
Explanation:
Dependabot security updates are automated pull requests triggered when GitHub detects a vulnerability in a dependency listed in your manifest or lockfile. These PRs upgrade the dependency to the minimum safe version that fixes the vulnerability.
This is separate from regular updates (which keep versions current even if not vulnerable).
NEW QUESTION # 37
Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?
- A. The build tool finds the vulnerable dependencies and calls the Dependabot API
- B. Dependabot reviews manifest files in the repository
- C. CodeQL analyzes the code and raises vulnerabilities in third-party dependencies
- D. A dependency graph is created, and Dependabot compares the graph to the GitHub Advisory database
Answer: D
Explanation:
Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.
This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.
NEW QUESTION # 38
What combination of security measures helps to mitigate risks throughout the SDLC (Software Development Life Cycle)?
- A. View alerts about dependencies that are known to contain security vulnerabilities
- B. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies
- C. Automatically raise pull requests, which reduces your exposure to older versions of dependencies
- D. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository's code
Answer: B
Explanation:
These three features provide a complete layer of defense:
Code scanning identifies security flaws in your source code
Secret scanning detects exposed credentials
Dependency review shows the impact of package changes during a pull request Together, they give developers actionable insight into risk and coverage throughout the SDLC.
NEW QUESTION # 39
What kind of repository permissions do you need to request a Common Vulnerabilities and Exposures (CVE) identification number for a security advisory?
- A. Write
- B. Admin
- C. Triage
- D. Maintain
Answer: B
Explanation:
Anyone with admin permissions to a security advisory can request a CVE identification number.
NEW QUESTION # 40
In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
- A. Read-only access to all the repository's files
- B. Read-only access to the dependency manifest and lock files for a repository
- C. Dependency graph enabled at the organization level for all new private repositories
- D. Write access to the dependency manifest and lock files for an enterprise
Answer: B,C
Explanation:
Comprehensive and Detailed Explanation:
To generate a dependency graph for a private repository, GitHub requires:
Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.
Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
NEW QUESTION # 41
Which of the following dependencies could trigger a Dependabot alert? Each answer presents a complete solution. (Choose two.)
- A. direct dependencies at 08:00 UTC
- B. loose dependencies declared in a manifest
- C. indirect dependencies explicitly declared in a lockfile
- D. direct dependencies explicitly declared in a manifest
Answer: C,D
Explanation:
[B]
A Dependabot direct dependency is a package or library that your project explicitly lists and requires in its manifest file (like package.json or Gemfile). Dependabot specifically focuses on these direct dependencies, creating automated pull requests to update them to newer, more secure, or stable versions, helping to keep your project's dependencies up-to-date and prevent security vulnerabilities.
[D]
Direct dependencies may have their own dependencies, which are referred to as transitive dependencies or indirect dependencies.
Locked Files and Dependencies
A locked file in software development is a file that records the exact versions of all dependencies (both direct and transitive) used in a project at a specific point in time. It acts as a snapshot of the dependency graph, ensuring that the project builds consistently with the same versions across different environments.
NEW QUESTION # 42
Where can you use CodeQL analysis for code scanning? Each answer presents part of the solution. (Choose two.)
- A. in the Files changed tab of the pull request
- B. in an external continuous integration (CI) system
- C. in a workflow
- D. in a third-party Git repository
Answer: B,C
Explanation:
In a workflow: GitHub Actions workflows are the most common place for CodeQL code scanning.
The codeql-analysis.yml defines how the analysis runs and when it triggers.
In an external CI system: GitHub allows you to run CodeQL analysis outside of GitHub Actions.
Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.
You cannot run or trigger analysis from third-party repositories directly, and the Files changed tabin pull requests only shows diff - not analysis results.
NEW QUESTION # 43
What is the first step you should take to fix an alert in secret scanning?
- A. Remove the secret in a commit to the main branch.
- B. Update your dependencies.
- C. Revoke the alert if the secret is still valid.
- D. Archive the repository.
Answer: C
Explanation:
The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.
Simply deleting the secret from the code does not remove the risk if it hasn't been revoked - especially since it may already be exposed in commit history.
NEW QUESTION # 44
To be compatible with code scanning, what data format must third-party code scanning tools use for output?
- A. YAML
- B. Static Analysis Results Interchange Format (SARIF)
- C. ESLint
- D. comma separated values (CSV)
Answer: B
Explanation:
About code scanning
You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.
About third-party code scanning tools
Code scanning is interoperable with third-party code scanning tools that output Static Analysis Results Interchange Format (SARIF) data. SARIF is an open standard. For more information,
NEW QUESTION # 45
Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?
- A. non-provider patterns
- B. custom pattern dry runs
- C. push protection
- D. secret validation
Answer: C
Explanation:
Push protection is a secret scanning feature that is designed to prevent sensitive information, such as secrets or tokens, from being pushed to your repository in the first place. Unlike secret scanning, which detects secrets after they have been committed, push protection proactively scans your code for secrets during the push process and blocks the push if any are detected.
Push protection helps you avoid the risks associated with exposed secrets, like unauthorized access to resources or services. With this feature, developers get immediate feedback and can address potential issues before they become a security concern.
NEW QUESTION # 46
If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?
- A. Users with Admin privileges to the repository
- B. Users with Read permissions to the repository
- C. Users with Write permissions to the repository
- D. Users with Maintain privileges to the repository
Answer: C
Explanation:
By default, users with Write, Maintain, or Admin permissions will receive notifications for new Dependabot alerts. However, Write permission is the minimum level needed to be automatically notified. Users with only Read access do not receive alerts unless added explicitly.
NEW QUESTION # 47
When using CodeQL, how does extraction for compiled languages work?
- A. by resolving dependencies to give an accurate representation of the codebase
- B. by generating one language at a time
- C. by running directly on the source code
- D. by monitoring the normal build process
Answer: D
Explanation:
For compiled languages, CodeQL performs extraction bymonitoring the normal build process.
This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.
This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.
NEW QUESTION # 48
......
Microsoft GH-500 Exam Practice Test Questions: https://www.actualpdf.com/GH-500_exam-dumps.html
GH-500 Dumps 2026 - New Microsoft GH-500 Exam Questions: https://drive.google.com/open?id=1Y1T6IlIyMt0DZ7iyALr_O3uQd4Y04u3O
