GitHub Advanced Security (GH-500) Exam Questions

Domain 1: Describe GitHub Security suites, features, and ecosystem (15–20%)

An open source maintainer has a public repository on GitHub.com and hasn’t bought GitHub Secret Protection or GitHub Code Security. Which features can they still use on that repository? (select three)

⬜ Code scanning
⬜ Copilot Autofix
⬜ Push protection
⬜ Custom patterns for secret scanning
⬜ Security campaigns
⬜ Delegated bypass for push protection

A public repository has secret scanning turned on for free. The maintainers also want AI detection of hardcoded passwords. What do they need?

⬜ GitHub Secret Protection, because AI-detected secrets aren’t free on public repositories
⬜ Nothing; AI-detected secrets are on by default for public repositories
⬜ A GitHub Copilot Pro subscription for each maintainer
⬜ GitHub Code Security

A CISO asks what the free secret risk assessment report will show. Which items are included? (select two)

⬜ Preventable leaks that push protection could have blocked
⬜ Secrets found in public repositories
⬜ A list of the developers who committed each secret
⬜ Automatic revocation of every secret found
⬜ A cost estimate for each leaked credential

An organization without GitHub Code Security runs the code security risk assessment. Which statements are correct? (select two)

⬜ It scans up to 20 repositories, preselected by commit activity in the last 90 days.
⬜ It can be rerun every 90 days, and the Actions minutes it uses are free.
⬜ It scans every repository in the organization.
⬜ It requires a Code Security license for the selected repositories.
⬜ Results replace the secret risk assessment in the same tab.

How does GitHub Secret Protection differ from the secret risk assessment? (select two)

⬜ Secret Protection monitors continuously; the assessment is a point-in-time scan.
⬜ Secret Protection scans beyond code, including pull requests, issues, wikis and discussions.
⬜ The assessment blocks pushes, while Secret Protection only reports.
⬜ Secret Protection is free, while the assessment is paid.
⬜ The assessment includes custom patterns, while Secret Protection doesn’t.

A security lead wants to know which types of secret push protection blocks and which teams bypass it most. Which security overview view should they open?

⬜ Secret scanning
⬜ Coverage
⬜ Enablement
⬜ CodeQL pull requests

An organization owner wants to see which repositories have AI Scan for pull requests effectively enabled. Where can they check?

⬜ The Coverage view of security overview
⬜ The Risk view of security overview
⬜ Each repository’s Insights tab
⬜ The enterprise audit log only

A repository with open alerts is archived today. An analyst then views last week in the security overview dashboard. What do they see? (select two)

⬜ The repository appears only when the filter includes archived repositories.
⬜ Its alerts show as open for last week, matching their state at that time.
⬜ Its alerts are removed from all historical figures.
⬜ The repository appears as active, because last week it was.
⬜ Its alerts show as closed for last week.

A developer who belongs to the organization, but isn’t an owner or security manager, opens security overview. What data do they see?

⬜ Only repositories where they have access to security alerts
⬜ All repositories in the organization, without alert details
⬜ No data; security overview is limited to owners
⬜ All repositories they can read, including alerts they can’t otherwise access

A research team wants security overview data in a spreadsheet to combine with an external asset inventory. What does security overview support?

⬜ Downloading CSV files of data from several security overview pages
⬜ Exporting SARIF files of all alert types
⬜ Only screenshots of dashboards
⬜ Exporting data only through the audit log stream

What is the difference between security configurations and global settings for an organization?

⬜ Security configurations control repository-level features; global settings control organization-level settings that repositories inherit.
⬜ Security configurations apply only to public repositories; global settings apply to private ones.
⬜ Global settings replace security configurations once enabled.
⬜ Security configurations are for enterprises only; global settings are for organizations.

A team writes PHP and Terraform, which CodeQL doesn’t cover. Which statements about AI Scan for pull requests are correct? (select two)

⬜ Its findings appear only on pull requests, not as backlog alerts in the security view.
⬜ Its findings are advisory and don’t block merges.
⬜ It scans the whole repository nightly.
⬜ It needs a build system to analyze the code.
⬜ It requires CodeQL default setup to be enabled.

A team wants AI Scan findings to block merges and to cover Dependabot pull requests. What should they know?

⬜ AI Scan findings can’t be used in rulesets yet, and AI Scan doesn’t run on Dependabot or fork pull requests.
⬜ Both are possible with a branch ruleset.
⬜ AI Scan blocks merges by default but skips Dependabot.
⬜ AI Scan only runs on Dependabot pull requests.

Before AI Scan can be used in an organization’s repositories, what must happen?

⬜ An enterprise owner allows it, then an organization administrator enables it.
⬜ Each repository admin enables it; enterprise policy doesn’t apply.
⬜ It is on by default for all organizations with Code Security.
⬜ A model must be selected for each repository.

A developer wants to ask Copilot Chat to explain code scanning, secret scanning and Dependabot alerts in their organization’s repositories. Which license enables this?

⬜ GitHub Copilot Enterprise
⬜ GitHub Copilot Free
⬜ GitHub Secret Protection alone
⬜ No license; it is part of security overview

According to GitHub’s end-to-end supply chain guidance, which areas must be secured besides dependencies?

⬜ Personal accounts, code and build processes
⬜ Only third-party libraries and frameworks
⬜ Only package registries
⬜ Only production servers

Which build system property helps stop a compromised build from affecting later builds?

⬜ Each build starts in a fresh environment.
⬜ Builds reuse a cached runner to speed up steps.
⬜ Build instructions are kept outside the repository.
⬜ Builds run only on a developer’s workstation.

A company on GitHub Team wants artifact attestations for builds from its private repositories. What is required?

⬜ GitHub Enterprise Cloud; on Free, Pro and Team plans, attestations are only for public repositories.
⬜ GitHub Secret Protection.
⬜ Nothing extra; attestations work in all private repositories.
⬜ GitHub Code Security.

Which statements about artifact attestations are correct? (select two)

⬜ They record provenance, such as the workflow, repository, commit SHA and triggering event.
⬜ GitHub’s signing authority handles signing, so you don’t manage your own keys.
⬜ They replace the need for dependency review.
⬜ They can only be created for container images.
⬜ They are generated automatically for every Actions run.

A maintainer enables immutable releases. What is still possible after a release is published? (select two)

⬜ Editing the release title and notes
⬜ Changing whether it is marked as the latest release
⬜ Replacing a release asset with a rebuilt binary
⬜ Moving the tag to a newer commit
⬜ Reusing the tag name after deleting the release

What workflow does GitHub recommend for publishing an immutable release?

⬜ Create a draft release, attach all assets, then publish it.
⬜ Publish the release, then upload assets within one hour.
⬜ Publish with no assets and attach them in a follow-up release.
⬜ Push the tag first, then enable immutability.

A security team prefers prevention-first controls that stop secrets before they’re saved to GitHub. Which features act at that point? (select two)

⬜ Push protection on the repository
⬜ Push protection for users on public repositories
⬜ Dependabot alerts
⬜ The secret risk assessment
⬜ Code scanning on the default branch

A company follows GitHub’s phased approach to adopting Advanced Security at scale. Which statements are correct? (select two)

⬜ The pilot phase is optional.
⬜ Secret scanning needs less configuration than code scanning, so it’s simpler to adopt.
⬜ Code scanning must be rolled out to every repository before any planning.
⬜ Internal documentation is created only after the full rollout.
⬜ There are three phases.

Which security features are available on every GitHub plan, without buying Secret Protection or Code Security? (select three)

⬜ Dependency graph
⬜ Dependabot alerts and security updates
⬜ Repository rulesets
⬜ Secret scanning on private repositories
⬜ Code scanning on private repositories
⬜ Dependency review on private repositories

An organization on GitHub Enterprise Cloud has no Advanced Security products. What security overview data can it still use?

⬜ Dependabot data for its repositories, and secret risk assessment
⬜ Code scanning and secret scanning data for private repositories
⬜ Nothing; security overview needs a product license
⬜ Security campaigns only

A repository once ran a CodeQL workflow that was later deleted, and its alerts never close. What explains this, and what should you do?

⬜ Stale configurations keep showing outdated alert statuses; delete the stale configuration from the branch.
⬜ Alerts close automatically after 90 days; wait.
⬜ Dismiss every alert as “Won’t fix”.
⬜ Re-enable the deleted workflow and disable it again.

Delegated alert dismissal is being planned across a GitHub Enterprise Server estate. Which alert types does it cover?

⬜ Code scanning and secret scanning from GHES 3.17, and Dependabot alerts from GHES 3.21
⬜ Only secret scanning alerts
⬜ Only code scanning alerts
⬜ All alert types from GHES 3.10

A code campaign is built from filters. A matching alert exists only on a release branch, not on the default branch. Is it included?

⬜ No; code scanning alerts in campaigns must be on the default branch.
⬜ Yes; campaigns include alerts from all branches.
⬜ Yes, but only if the branch is protected.
⬜ Only if the alert is assigned to a user.

Why might a security lead choose a security campaign over emailing developers a spreadsheet of alerts?

⬜ Developers are notified and see the selected alerts in their normal workflow, with a named point of contact.
⬜ Campaigns dismiss alerts automatically after the due date.
⬜ Campaigns give developers admin access to fix alerts.
⬜ Campaigns hide alerts outside the campaign from developers.

A team lead wants to make Dependabot alert ownership clear. Who can assign Dependabot alerts, and to whom?

⬜ Users with write access or higher, to collaborators, teams or AI agents
⬜ Only organization owners, to individual users
⬜ Anyone with read access, to any GitHub user
⬜ Only security managers, to teams only

A security manager plans to track Dependabot alert assignments across the organization in security overview. What limitation applies?

⬜ Assignments are visible only in each repository’s alerts view; organization security overview doesn’t show them.
⬜ Assignments appear only in the enterprise audit log.
⬜ Assignments are shown in security overview but can’t be filtered.
⬜ Assignments expire after 30 days.

A developer assigns a Dependabot alert to an AI agent, but the agent can’t produce a fix. What happens?

⬜ The agent remains the assignee, and View Session on the alert timeline shows its log.
⬜ The alert is dismissed automatically as “inaccurate”.
⬜ The alert is reassigned to the repository admin.
⬜ The agent opens an empty pull request.

An enterprise owner restricts GitHub Advanced Security with policies and expects GitHub Code Quality to be restricted too. Is it?

⬜ No; Advanced Security policies don’t control Code Quality, which has its own policy.
⬜ Yes; Code Quality is part of Code Security.
⬜ Yes, but only for private repositories.
⬜ Code Quality can’t be restricted at all.

Training material for GitHub.com and GitHub Enterprise Server users must describe where repository security alerts appear. What is accurate?

⬜ GitHub.com and GitHub Enterprise Cloud show a Security and quality tab; GitHub Enterprise Server docs refer to a Security tab.
⬜ Both show a tab named Advanced Security.
⬜ Both show alerts only in the Insights tab.
⬜ GitHub Enterprise Server shows Security and quality, while GitHub.com shows Security.

An enterprise decides to stop using GitHub Advanced Security entirely. What can an enterprise owner do?

⬜ Disable GitHub Advanced Security across all repositories and prevent it being re-enabled.
⬜ Only disable it repository by repository.
⬜ Disable it only by contacting GitHub Sales.
⬜ Nothing; licenses can only expire.

A team has the security manager role. A repository admin wants that team to have less access to their repository. What can the admin do?

⬜ Change the team’s access level for the repository, but not remove its access
⬜ Remove the team’s access completely
⬜ Revoke the security manager role from the team
⬜ Nothing; the team’s access can’t be changed

A company’s code is in Azure Repos, not GitHub, and it wants GitHub’s security scanning. What do the docs point to?

⬜ GitHub Advanced Security for Azure DevOps, documented on Microsoft Learn
⬜ Mirroring the repositories to GitHub is the only option.
⬜ The CodeQL CLI with github upload-results to Azure Repos.
⬜ Secret Protection configured from GitHub Enterprise Cloud for Azure Repos.

Domain 2: Configure and use Secret Protection (15–20%)

A repository has a docs folder full of sample credentials that keep raising secret scanning alerts. Which file excludes that folder from secret scanning?

⬜

# .github/secret_scanning.yml
paths-ignore:
  - "docs/**"

⬜

# .github/dependabot.yml
secret-scanning:
  exclude-paths:
    - "docs/**"

⬜

# .github/codeql/codeql-config.yml
paths-ignore:
  - "docs/**"

⬜

# .gitignore
docs/**

A developer adds a path to paths-ignore in .github/secret_scanning.yml. What happens to secrets found in that path? (select two)

⬜ Their alerts are closed as “ignored by configuration”.
⬜ Pushes that add secrets to that path aren’t blocked by push protection.
⬜ Their alerts are deleted from the repository’s alert history.
⬜ Their alerts move to the Generic alerts list.
⬜ The secrets are still sent to partners as a dismissed alert.

A monorepo team generates a secret_scanning.yml file with 1,400 paths-ignore entries. The file is 300 KB. How does secret scanning handle it?

⬜ It excludes only the first 1,000 entries.
⬜ It ignores the whole file because the entry limit is exceeded.
⬜ It applies all 1,400 entries, since the file is under 1 MB.
⬜ It rejects the commit that adds the file.

A developer’s push contains eight new secrets, and push protection blocks it. How many secrets does the block message show?

⬜ The first five
⬜ All eight
⬜ Only the first one
⬜ None, only a link to the alert list

Repository push protection is enabled, yet a push containing a supported secret wasn’t blocked. Which situations can explain this? (select three)

⬜ The push contains more than 1,000 secrets that already have alerts.
⬜ The push to a public repository is larger than 50 MB.
⬜ The push is so large that the push protection scan timed out.
⬜ The push contains more than five new secrets.
⬜ The secret was committed with a signed commit.
⬜ The pusher has write access to the repository.

A reviewer opens a push protection bypass request that shows no commit or file path. What does that mean?

⬜ Push protection ran out of time locating the commit that introduced the secret.
⬜ The requester deleted the branch after submitting the request.
⬜ The secret matched a custom pattern that hasn’t been published.
⬜ The request has expired and can no longer be approved.

An AWS access key ID is committed in config/app.env, and the matching secret access key in config/secrets.env in the same repository. What does secret scanning do?

⬜ It raises no alert for the pair, because the ID and secret must be in the same file.
⬜ It raises one alert linking both files.
⬜ It raises two separate alerts, one per file.
⬜ It raises an alert in the Generic alerts list.

A company runs GitHub Enterprise Server and GitHub Enterprise Cloud. An engineer commits a legacy GitHub Enterprise Server personal access token to a repository on GitHub Enterprise Cloud. Why might no alert appear?

⬜ GitHub tokens are validity-checked, so a GitHub Enterprise Server token isn’t detected on GitHub Enterprise Cloud.
⬜ GitHub tokens are only detected when validity checks are turned off.
⬜ Personal access tokens are partner patterns and only go to the provider.
⬜ Legacy tokens are detected only by push protection, not by scanning.

A script calls the REST API “Create or update file contents” endpoint with a file that contains a supported secret. Push protection is enabled for the repository. Which responses can the script take to complete the request? (select two)

⬜ Remove the secret from the request content and try again.
⬜ Call the “Create a push protection bypass” endpoint, then retry.
⬜ Retry using the “Create a blob” endpoint, which isn’t covered by push protection.
⬜ Add a force: true parameter to skip the push protection check.
⬜ Wait three hours, after which the same request is allowed.

A developer edits a file in the GitHub web UI that contains two supported secrets. One already has an open alert in the repository. How does push protection behave?

⬜ It blocks only the new secret, showing one detected secret at a time.
⬜ It blocks both secrets and lists them together.
⬜ It blocks neither, since the web UI is not covered by push protection.
⬜ It blocks the commit until the existing alert is closed.

When push protection blocks a commit, an organization wants developers to see a page about its secrets vault and escalation contacts. What can the organization owner configure?

⬜ A custom link that is displayed when a push is blocked
⬜ A custom bypass reason that replaces “I’ll fix it later”
⬜ A SECURITY.md file that push protection opens automatically
⬜ A required comment template on every bypass request

A developer’s command-line push is blocked. A teammate opens the bypass URL from the error message to allow the secret for them. What happens?

⬜ The teammate gets a 404 error, because only the user who pushed can use the URL.
⬜ The teammate can allow the secret if they have write access.
⬜ The teammate is shown a form to submit a bypass request on the pusher’s behalf.
⬜ The URL works for anyone for three hours.

Push protection blocks a push. The secret was introduced in commit 8728dbe67, three commits before the branch tip. Which command starts the recommended fix?

⬜

git rebase -i 8728dbe67~1

⬜

git commit --amend --all

⬜

git revert 8728dbe67

⬜

git push --force-with-lease

A developer pushes a supported secret to a public repository that doesn’t have secret scanning enabled. Push protection for users is on. What happens?

⬜ The push is blocked, and if they allow the secret no reason is needed and no alert is created.
⬜ The push is allowed, and an open alert is created for the repository owner.
⬜ The push is blocked, and allowing it creates an open alert in the developer’s account.
⬜ The push is blocked until a repository admin approves a bypass request.

A migration bot pushes thousands of historical commits that contain test credentials. The organization uses delegated bypass and wants the bot to push without being checked. What should the owner do?

⬜ Add the bot to the bypass list in a security configuration and mark it Exempt.
⬜ Add the bot to the bypass list so it can approve its own requests.
⬜ Give the bot the security manager role.
⬜ Disable push protection on the target repositories during migration.

A repository admin finds the push protection bypass list settings disabled on their repository’s Advanced Security page. What is the most likely reason?

⬜ Delegated bypass has been configured at the organization or enterprise level.
⬜ The repository is private and needs Code Security as well.
⬜ The admin isn’t a member of the security manager team.
⬜ Push protection for users is turned off for the admin.

Delegated bypass is enabled for an organization. Which users can always bypass push protection? (select three)

⬜ Organization owners
⬜ Security managers
⬜ Users with a custom role that has the “review and manage secret scanning bypass requests” permission
⬜ Any user with write access to the repository
⬜ Any user with read access to the repository
⬜ Enterprise billing managers

A security team wants an internal policy engine to approve push protection bypass requests automatically. What does GitHub support for this?

⬜ A GitHub App with the “Organization bypass requests for secret scanning” fine-grained permission
⬜ A secret_scanning.yml rule that auto-approves requests
⬜ A repository ruleset with automatic approval
⬜ An outgoing webhook that GitHub calls to decide each request

A developer’s bypass request for a blocked secret is approved. What can they now push?

⬜ The commit with that secret, and future commits containing the same secret
⬜ Only the exact commit named in the request, within one hour
⬜ Any secret to that repository for seven days
⬜ The commit, but only after an admin closes the alert

An engineer writes a custom pattern using a regex option modifier taken from a PCRE example, and it fails. What explains this?

⬜ Custom patterns support only Hyperscan constructs, and option modifiers aren’t supported.
⬜ Custom patterns use JavaScript regex syntax.
⬜ Custom patterns accept only literal strings, not regular expressions.
⬜ Option modifiers work only in enterprise-level patterns.

When defining a custom pattern, you leave Before secret at its default value. What does that default require?

⬜ The secret is at the start of a line or follows a non-alphanumeric character.
⬜ The secret follows a = or : character.
⬜ The secret is enclosed in quotation marks.
⬜ Nothing; the field is empty by default.

A platform team plans its custom pattern library. How many custom patterns can be defined?

⬜ Up to 500 per organization or enterprise, and up to 100 per repository
⬜ Up to 100 per organization, and up to 20 per repository
⬜ Up to 1,000 per enterprise, with no repository limit
⬜ An unlimited number at every level

An organization owner runs a dry run of a new custom pattern. Which statements describe the dry run? (select two)

⬜ It can run on all repositories in the organization or on up to 10 selected repositories.
⬜ It shows a sample of up to 1,000 results.
⬜ It can run on up to 50 selected repositories.
⬜ It returns every match in the organization, however many there are.
⬜ It enables push protection for the pattern in the selected repositories.

A security engineer leaves the company. A colleague wants to edit one of the engineer’s custom patterns, defined at the enterprise level. What restriction applies?

⬜ At the enterprise level, only the pattern’s creator can edit it and use it in a dry run.
⬜ Any enterprise owner can edit it, but only security managers can dry-run it.
⬜ Enterprise patterns can’t be edited, only deleted and recreated.
⬜ Edits must be approved by an organization owner in each organization.

An administrator tightens the regex of a published custom pattern to cut false positives and saves the change. What happens to alerts from the old version?

⬜ All alerts created with the previous version of the pattern are closed.
⬜ They stay open until each one is reviewed manually.
⬜ They are moved to the Generic alerts list.
⬜ They are kept, and new matches are added as duplicates.

An organization deletes a custom pattern that generated thousands of alerts. What happens?

⬜ The admin chooses to close or keep the related alerts; closing runs asynchronously and can take a while.
⬜ All related alerts are deleted at once.
⬜ The alerts stay open, and the pattern can’t be deleted until they are resolved.
⬜ The alerts are reassigned to the closest provider pattern.

An admin wants help writing a custom pattern regex from a plain-English description. The organization has Secret Protection but no Copilot licenses. What can they do?

⬜ Use Generate with AI when creating the pattern, since no Copilot subscription is required.
⬜ Nothing until a Copilot Business license is assigned to the admin.
⬜ Use Generate with AI only at the enterprise level.
⬜ Ask the Security Lab to create the pattern for them.

An organization owner wants AI-detected password scanning on all repositories. How should they turn it on?

⬜ Create or edit a custom security configuration with “Scan for AI-detected secrets” enabled, then apply it.
⬜ Turn it on in organization Global settings, which applies to every repository.
⬜ Assign Copilot licenses to all committers.
⬜ Add a secret_scanning.yml file that enables AI detection.

Which statements about generic and AI-detected secrets are correct? (select two)

⬜ Validity checks aren’t supported for generic patterns such as private keys.
⬜ Push protection and validity checks aren’t supported for AI-detected passwords.
⬜ Generic patterns are sent to partner providers for revocation.
⬜ AI-detected passwords block pushes by default once enabled.
⬜ Generic pattern alerts appear in the security overview summary views.

A repository has years of private keys and connection strings in its history. Generic pattern scanning is enabled. What limitation should the team expect?

⬜ Generic alerts are capped at 5,000 per repository, counting open and closed alerts.
⬜ Generic alerts are capped at 500 open alerts, and closed ones don’t count.
⬜ Only secrets from the last 90 days are scanned.
⬜ Generic alerts show every detected location on GitHub.

A Slack token is leaked in a public repository. The token type is in the partner program. A repository admin looks on the repository’s Security and quality tab. What will they find?

⬜ No alert; partner alerts go to the provider and aren’t shown on the tab or sent to repository admins.
⬜ A partner alert assigned to the commit author.
⬜ A closed alert marked “revoked by provider”.
⬜ An open alert in the Generic alerts list.

Validity checks are enabled. Which statements describe how GitHub checks a detected secret? (select two)

⬜ For some secrets, GitHub combines the token with context such as a host or URL.
⬜ You can usually run an on-demand check from the alert view.
⬜ GitHub uses the token to create a test resource to prove it works.
⬜ GitHub checks validity only once, when the alert is created.
⬜ GitHub rotates the secret automatically when it is found to be active.

A team wants alerts to show who owns a detected secret. They try to enable extended metadata checks, but the option is unavailable. What must be enabled first?

⬜ Validity checks
⬜ AI-detected secret scanning
⬜ Delegated alert dismissal
⬜ Generic pattern scanning

A developer deletes a leaked API key from the code and pushes the change. What happens to the secret scanning alert?

⬜ It stays open; secret scanning doesn’t close alerts when the token is removed.
⬜ It closes automatically as “fixed”.
⬜ It closes automatically as “revoked”.
⬜ It is deleted, because the secret no longer exists.

A branch ruleset uses the Require secret scanning alerts are resolved rule. When does it block a pull request from merging? (select two)

⬜ A secret scanning scan hasn’t completed for the pull request’s head commit.
⬜ A commit in the pull request introduced an open alert for a secret type the ruleset selects.
⬜ The repository has any open secret scanning alert on any branch.
⬜ The pull request contains an AI-detected password.
⬜ A push protection bypass was used anywhere in the repository in the last 7 days.

Secret scanning detects a new secret in a recent push, and later a historical scan finds an older one. How are commit authors notified?

⬜ Authors are told about new secrets they committed, whatever their notification settings, but not about historical scan findings.
⬜ Authors are only notified if they watch the repository with “All Activity”.
⬜ Authors are notified of both, according to their notification settings.
⬜ Authors are never notified; only admins receive alerts.

An enterprise enables public monitoring for secret scanning. How does GitHub link secrets leaked in public repositories it doesn’t own back to the enterprise? (select two)

⬜ The secret was leaked by a member of the enterprise.
⬜ The secret was leaked by a user whose email matches one of the enterprise’s verified domains.
⬜ The secret matches a custom pattern defined in one of the enterprise’s organizations.
⬜ The repository was forked from an enterprise repository.
⬜ The repository has a topic that names the enterprise.

Domain 3: Configure and use supply chain security (15–20%)

A Gradle repository has a lock file parsed by static analysis, automatic dependency submission enabled, and a CI job that sends snapshots to the dependency submission API. Which source does the dependency graph show for that manifest?

⬜ The user-submitted snapshot from the CI job
⬜ The automatic dependency submission result
⬜ The static analysis of the lock file
⬜ A merged view of all three sources

A project has only a manifest file, and the dependency graph lists indirect dependencies inferred from it. Why might Dependabot not alert on a vulnerable indirect dependency?

⬜ Indirect dependencies inferred from manifest files, rather than lock files, are excluded from vulnerability checks.
⬜ Dependabot only checks direct dependencies in every ecosystem.
⬜ Indirect dependencies are only checked in public repositories.
⬜ Inferred dependencies are checked weekly rather than on every push.

Which statements describe Dependabot graph jobs? (select two)

⬜ They are supported for Go and Python dependencies.
⬜ They don’t use GitHub Actions minutes, unlike automatic dependency submission.
⬜ They must be enabled in dependabot.yml with a graph key.
⬜ They run only after automatic dependency submission has failed.
⬜ They fail the job if a private package can’t be accessed.

A repository admin wants to turn on automatic dependency submission for a Maven project. Which statements are true? (select two)

⬜ The dependency graph and GitHub Actions must both be enabled for the repository.
⬜ By default it runs on GitHub-hosted runners and counts toward Actions minutes.
⬜ It runs only when someone triggers it manually from the Actions tab.
⬜ It requires a dependabot.yml file with a maven entry.
⬜ It uploads results by creating SARIF files.

An organization wants automatic dependency submission to use a GitHub-hosted larger runner. What runner setup is required?

⬜ An organization-level larger runner named dependency-submission, with “Enabled for labeled runners” selected
⬜ A runner labeled code-scanning in the default runner group
⬜ A self-hosted runner labeled dependabot
⬜ Any larger runner, chosen by setting runs-on in dependabot.yml

Two CI workflows submit dependency snapshots for the same repository. Which values decide whether a new snapshot replaces an earlier one?

⬜ The combination of job.correlator and detector.name
⬜ The commit sha alone
⬜ The ref and the scanned timestamp
⬜ The name of the workflow file

A fine-grained personal access token will be used to call the “Create a snapshot of dependencies” endpoint. Which repository permission does it need?

⬜ Contents: write
⬜ Security events: write
⬜ Dependabot alerts: read
⬜ Administration: write

A team submits build-time dependencies through the dependency submission API. Where will those dependencies appear?

⬜ In the repository dependency graph and in dependency review, but not in the organization’s dependency insights
⬜ Only in the organization’s dependency insights
⬜ In dependency insights and the repository graph, but not in dependency review
⬜ Only in the SBOM export

The dependency review action runs in a separate workflow from the action that submits build-time dependencies, and it sometimes misses them. Which setting does GitHub recommend?

⬜ Set retry-on-snapshot-warnings to true, with a timeout longer than the submission run.
⬜ Set fail-on-severity to low so missing data is flagged.
⬜ Run the review action on schedule instead of pull_request.
⬜ Add allow-ghsas for advisories found by the submission action.

An advisory for a package your repository uses appears in the GitHub Advisory Database as unreviewed. What happens?

⬜ No Dependabot alert is created, because unreviewed advisories aren’t checked or mapped by GitHub.
⬜ A Dependabot alert is created with severity Low until review finishes.
⬜ A Dependabot security update pull request is opened, but no alert.
⬜ A malware alert is created.

A script validates GitHub Advisory Database IDs. Which ID is valid?

⬜ GHSA-49wp-qq6x-g2rf
⬜ GHSA-4b1a-qq6x-g2rf
⬜ GHSA-49WP-QQ6X-G2RF
⬜ GHSA-49wp-qq6x

A team wants to prioritize Dependabot alerts using EPSS. Which statements are correct? (select two)

⬜ EPSS gives the probability that a vulnerability will be exploited in the next 30 days, plus a percentile.
⬜ epss_percentage:>0.01 filters for alerts with more than a 1% predicted chance of exploitation.
⬜ EPSS is calculated by GitHub from the number of repositories that use the package.
⬜ EPSS replaces the CVSS severity on the alert.
⬜ Community contributors can edit an advisory’s EPSS score.

Malware alerts are enabled for a repository. Which statements about Dependabot malware alerts are correct? (select two)

⬜ An internal package with the same ecosystem, name and version as a malicious public package can cause a false positive.
⬜ Dependabot doesn’t open pull requests to resolve malware alerts.
⬜ Malware alerts are available only for npm.
⬜ Archived repositories are scanned weekly for malware.
⬜ GitHub publicly lists repositories that use malicious packages.

Which alerts does GitHub’s preset rule “Dismiss low impact issues for development-scoped dependencies” auto-dismiss?

⬜ Alerts for npm development dependencies whose weakness is on a GitHub-curated CWE list
⬜ All alerts with Low severity, in any ecosystem
⬜ Alerts for any development dependency, whatever the weakness
⬜ Alerts whose EPSS score is below 1%

Which alert metadata can a custom Dependabot auto-triage rule target? (select three)

⬜ EPSS score
⬜ Patch availability
⬜ Dependency scope
⬜ Commit author of the manifest change
⬜ Repository topic
⬜ Number of days the alert has been open

A security manager creates an organization-level auto-triage rule that repository administrators must not be able to turn off. Which option should they choose?

⬜ Enforced
⬜ Enabled
⬜ Evaluate
⬜ Active

A repository admin creates a rule with “Open a pull request to resolve this alert” for critical alerts only. Dependabot keeps opening pull requests for every patched alert. Why?

⬜ Dependabot security updates are enabled; they must be disabled for the rule to control which alerts get pull requests.
⬜ The rule needs a dependabot.yml file to take effect.
⬜ Organization rules always open pull requests for every alert.
⬜ Pull request rules only apply to malware alerts.

An organization rule auto-dismisses an alert, while a repository rule would open a pull request for it. What happens?

⬜ The organization rule takes precedence, and dismissal rules act before pull request rules.
⬜ The repository rule wins because it is more specific.
⬜ Both actions run: the alert is dismissed and a pull request opens.
⬜ Neither runs until an admin resolves the conflict.

Grouped security updates are enabled in organization Global settings and disabled in the repository’s settings. The repository’s dependabot.yml defines a groups entry with applies-to: security-updates. Which setting wins?

⬜ The dependabot.yml group rules
⬜ The organization Global settings
⬜ The repository UI setting
⬜ Whichever was changed most recently

A vulnerable transitive dependency can only be fixed by also upgrading its parent package. In which ecosystem can Dependabot security updates make that change?

⬜ npm
⬜ Maven
⬜ pip
⬜ NuGet

A developer dismisses a Dependabot alert from the alert page. Which dismissal reasons can they choose? (select three)

⬜ A fix has already been started
⬜ No bandwidth to fix this
⬜ Risk is tolerable to this project
⬜ Used in tests
⬜ Won’t fix
⬜ Revoked

Which statements about managing individual Dependabot alerts are correct? (select two)

⬜ Alerts that have already been fixed can’t be reopened.
⬜ A dismissal comment can be read or set with the GraphQL API’s dismissComment field.
⬜ Closed alerts can’t be selected in bulk; each must be reopened separately.
⬜ Only organization owners can dismiss Dependabot alerts.
⬜ Dismissal comments are visible only to the person who wrote them.

An auditor asks for a software bill of materials for a repository. Which statements about GitHub’s SBOM export are correct? (select two)

⬜ Anyone with at least read access can export it from Insights > Dependency graph > Export SBOM, or with the REST API.
⬜ It uses the SPDX format and doesn’t list dependents.
⬜ It requires GitHub Code Security on private repositories.
⬜ It is exported in CycloneDX format by default.
⬜ It includes only direct dependencies.

A dependabot.yml entry sets target-branch: develop for npm, along with labels and assignees. What happens to Dependabot security updates for npm?

⬜ They still target the default branch, and that entry’s options no longer apply to them.
⬜ They target develop and use the same labels and assignees.
⬜ They stop, because security updates can’t run with target-branch.
⬜ They target both branches.

A team wants Dependabot security updates for its npm project but no version update pull requests. Which configuration does this?

⬜

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 0

⬜

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "never"

⬜

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    ignore:
      - dependency-name: "*"

⬜

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 0

In dependabot.yml, allow lists express, and ignore also lists express. What does Dependabot do with express?

⬜ It ignores express, because matching ignore rules are removed after allow is applied.
⬜ It updates express, because allow takes precedence.
⬜ It rejects the configuration file as invalid.
⬜ It updates express for security updates only and ignores it for version updates.

A dependabot.yml defines a group aws with pattern aws-*, followed by a group sdk with pattern *-sdk. Where does Dependabot put an update to aws-sdk?

⬜ In the aws group, because a dependency goes into the first group it matches
⬜ In the sdk group, because the last match wins
⬜ In both groups, as two pull requests
⬜ In an individual pull request, because it matches more than one group

A library’s package.json declares "left-pad": "^1.0.0", and version 2.0.0 is released. With versioning-strategy: widen, what constraint does Dependabot propose?

⬜ >=1.0.0 <3.0.0
⬜ ^2.0.0
⬜ ^1.0.0, with only the lock file updated
⬜ 2.0.0 pinned exactly

A company mirrors npm packages in an internal Artifactory registry and wants Dependabot to resolve all npm packages there instead of the public registry. Which registry setting does this?

⬜ replaces-base: true on the npm registry definition
⬜ insecure-external-code-execution: allow
⬜ vendor: true under the npm entry
⬜ target-branch set to the mirror’s URL

Dependabot should check npm updates every day at 09:00 Berlin time using a cron schedule. Which schedule block is correct?

⬜

schedule:
  interval: "cron"
  cronjob: "0 9 * * *"
  timezone: "Europe/Berlin"

⬜

schedule:
  interval: "daily"
  cronjob: "0 9 * * * Europe/Berlin"

⬜

schedule:
  cron: "0 9 * * *"
  timezone: "CET"

⬜

schedule:
  interval: "cron"
  time: "0 9 * * *"

A cooldown block lists lodash under both include and exclude. A new lodash release comes out. What does Dependabot do?

⬜ It updates lodash without waiting, because exclude takes precedence.
⬜ It waits for the cooldown, because include is listed first.
⬜ It stops updating lodash entirely.
⬜ It applies the cooldown to security updates for lodash as well.

A platform team wants Docker image and Terraform provider updates combined into one weekly pull request. Which dependabot.yml feature does this?

⬜ multi-ecosystem-groups, with each ecosystem assigned using multi-ecosystem-group
⬜ A groups entry with applies-to: version-updates
⬜ group-by: dependency-name
⬜ Grouped security updates in the repository settings

A maintainer has edited a Dependabot pull request and wants to manage it with comment commands. Which statements are correct? (select two)

⬜ @dependabot recreate rebuilds the pull request and overwrites the edits.
⬜ @dependabot ignore this major version closes the pull request and stops pull requests for that major version.
⬜ @dependabot rebase discards the edits and opens a new pull request.
⬜ @dependabot ignore this dependency blocks the dependency permanently, even if the pull request is reopened.
⬜ @dependabot merge merges the pull request once checks pass.

An organization disables GitHub Actions for a repository that has Dependabot enabled. Which statements about Dependabot on GitHub Actions runners are correct? (select two)

⬜ Dependabot jobs still run on GitHub Actions, bypassing the Actions policy and disablement.
⬜ Dependabot on standard GitHub-hosted or self-hosted runners doesn’t count toward included Actions minutes.
⬜ Dependabot jobs run on self-hosted runners for public repositories when a dependabot label exists.
⬜ Dependabot workflows are committed to .github/workflows/dependabot.yml.
⬜ Dependabot on larger runners is free.

A team configures actions/dependency-review-action. Which options can they use? (select two)

⬜ allow-ghsas to skip specific advisories during detection
⬜ fail-on-scopes to block pull requests that add vulnerabilities in development or runtime scopes
⬜ allow-licenses and deny-licenses together in one configuration
⬜ fail-on-epss to fail when EPSS exceeds a threshold
⬜ ignore-manifests to skip lock files

Several repositories should share one dependency review configuration kept in a private repository, octo-org/policies. How should each workflow reference it?

⬜ Set config-file to octo-org/policies/dependency-review-config.yml@main and pass a token with read access in external-repo-token.
⬜ Copy the file to each repository’s .github/dependabot.yml.
⬜ Set config-file to the URL; private repositories are read with GITHUB_TOKEN.
⬜ Store the configuration as an organization variable named DEPENDENCY_REVIEW.

An organization owner wants every private repository to pass the dependency review action before merging. Which approach do the docs describe?

⬜ A repository ruleset that requires a workflow running the dependency review action, in repositories with Code Security
⬜ Enabling Dependabot security updates in Global settings
⬜ Adding the action to each repository’s dependabot.yml
⬜ Turning on dependency review in the dependency graph settings, which blocks merges by itself

Domain 4: Configure and use Code Security (10–15%)

A third-party scanner produces a 14 MB SARIF file that compresses to 11 MB with gzip. What happens when it’s uploaded to code scanning?

⬜ The upload is rejected, because the limit is 10 MB per gzip-compressed SARIF file.
⬜ It is accepted, because the limit applies to the uncompressed size.
⬜ It is accepted, but only the first 10 MB of results are processed.
⬜ It is accepted and split into two analyses automatically.

Which statements about SARIF upload limits are correct? (select two)

⬜ A SARIF file can contain at most 20 runs.
⬜ A run can include up to 25,000 results, but only the top 5,000, by severity, are included.
⬜ A run can include at most 1,000 results.
⬜ A file can contain only one run per language.
⬜ Each result can list an unlimited number of locations.

A SARIF run has runAutomationDetails.id set to my-analysis/tool1/2021-02-01. How does code scanning interpret it?

⬜ Category my-analysis/tool1, run ID 2021-02-01
⬜ Category my-analysis, run ID tool1/2021-02-01
⬜ No category; the whole string is the run ID
⬜ Category 2021-02-01, run ID my-analysis/tool1

A pipeline uploads one SARIF file for its backend and then another for its frontend, from the same tool for the same commit. Neither upload sets a category. What happens?

⬜ The second upload replaces the first set of results.
⬜ Both sets of results are merged into one analysis.
⬜ The second upload is rejected as a duplicate.
⬜ GitHub assigns each file a category from its file name.

A third-party SARIF file has no partialFingerprints. What does the upload-sarif action do?

⬜ It calculates partialFingerprints, which works only when the repository has both the SARIF file and the analyzed source code.
⬜ It rejects the file, because partialFingerprints is required.
⬜ It uploads the file, and every run creates new alerts.
⬜ It asks the tool vendor’s API for fingerprints.

A Jenkins server runs the CodeQL CLI and uploads results to GitHub. Which permission must its GitHub App or token have?

⬜ security_events write
⬜ contents write
⬜ actions write
⬜ checks write

A team runs CodeQL in an external CI system for a Java project. Which command sequence creates the database, analyzes it and uploads the results?

⬜

codeql database create java-db --language=java-kotlin --command='mvn clean install'
codeql database analyze java-db --format=sarif-latest --output=java.sarif
codeql github upload-results --repository=octo-org/app \
  --ref=refs/heads/main --commit=<SHA> --sarif=java.sarif

⬜

codeql database analyze --language=java-kotlin --output=java.sarif
codeql database create java-db --sarif=java.sarif
codeql github upload-results --sarif=java.sarif

⬜

codeql database init java-db --language=java-kotlin
codeql github upload-results --database=java-db --repository=octo-org/app

⬜

codeql database create java-db --language=java-kotlin --format=sarif-latest
codeql github upload-results --repository=octo-org/app --sarif=java-db

A CI job analyzes a Python database and a JavaScript database for the same commit, then uploads both SARIF files. Afterwards only the JavaScript results appear on GitHub. What was missed?

⬜ Setting --sarif-category for each codeql database analyze run
⬜ Using --db-cluster when uploading results
⬜ Adding --download to the analyze command
⬜ Passing --github-auth-stdin to the second upload

A developer creates a CodeQL database for a Python project with --command="pip install -r requirements.txt". The analysis finds nothing. Why?

⬜ For Python, JavaScript/TypeScript and Ruby, --command overrides the normal extractor and creates an empty database.
⬜ Python needs --build-mode manual with a build command.
⬜ pip install must run after codeql database analyze.
⬜ Python databases need --db-cluster.

Which statements about CodeQL build modes are correct? (select two)

⬜ none creates a database without building, for C/C++, C#, Java and Rust.
⬜ manual gives the most accurate analysis but needs build steps from the user.
⬜ none analyzes generated code more completely than autobuild.
⬜ autobuild is the only mode default setup uses for Java.
⬜ manual is available in default setup.

Default setup analyzes a repository with Java and Kotlin code and logs: “Detected X Kotlin files in your project that could not be processed without a build.” What does that mean?

⬜ Build mode none was used for Java, and Kotlin files aren’t included in the database.
⬜ Kotlin isn’t supported by CodeQL.
⬜ The Kotlin files contain syntax errors.
⬜ The repository needs a separate kotlin language entry.

A C repository has several build.sh scripts, and autobuild reports far fewer lines scanned than expected. What is the recommended fix?

⬜ Switch to build-mode: manual and run the same build commands used in production.
⬜ Add the folders to paths in the CodeQL configuration file.
⬜ Switch to the security-extended query suite.
⬜ Re-run autobuild with ACTIONS_STEP_DEBUG set.

Which statements about built-in CodeQL query suites are correct? (select two)

⬜ security-extended contains every query in default, plus lower-precision queries.
⬜ security-and-quality is available with advanced setup but not default setup.
⬜ default returns more false positives than security-extended.
⬜ security-and-quality contains only maintainability and reliability queries.
⬜ Custom query suites can be selected in default setup.

A workflow passes a CodeQL configuration file that lists custom queries. The team also wants security-and-quality added in the workflow without dropping the file’s queries. Which init step does this?

⬜

- uses: github/codeql-action/init@v4
  with:
    config-file: ./.github/codeql/codeql-config.yml
    queries: +security-and-quality

⬜

- uses: github/codeql-action/init@v4
  with:
    config-file: ./.github/codeql/codeql-config.yml
    queries: security-and-quality

⬜

- uses: github/codeql-action/init@v4
  with:
    config-file: ./.github/codeql/codeql-config.yml
    extra-queries: security-and-quality

⬜

- uses: github/codeql-action/init@v4
  with:
    config-file: +./.github/codeql/codeql-config.yml
    queries: security-and-quality

A CodeQL configuration file uses paths and paths-ignore. Which statements are correct? (select two)

⬜ They limit analysis for interpreted languages, or compiled languages analyzed without a build.
⬜ The characters ?, +, [, ] and ! are matched literally.
⬜ They decide whether the workflow runs for a pull request.
⬜ They limit which files are analyzed for C# built with autobuild.
⬜ **foo is a valid pattern.

A CodeQL workflow uses on.pull_request.paths-ignore: ['**/*.md']. A pull request changes README.md and src/app.js. What happens?

⬜ The workflow runs, and analysis isn’t limited to src/app.js.
⬜ The workflow is skipped, because the pull request touches a Markdown file.
⬜ The workflow runs and analyzes only src/app.js.
⬜ The workflow runs and excludes Markdown from analysis.

Which statements about code scanning alert severity are correct? (select two)

⬜ Every alert has a severity of Error, Warning or Note.
⬜ CodeQL security alerts also have a security severity of Critical, High, Medium or Low, which is shown instead of severity.
⬜ Security severity is chosen by the developer who dismisses the alert.
⬜ Security severity is the highest CVSS score of any CVE with a related CWE.
⬜ Third-party SARIF alerts always get a CodeQL security severity.

A code scanning alert shows a Test label next to its title. What does the label mean?

⬜ The alert is in test code, rather than application code.
⬜ The alert was raised by an experimental query.
⬜ The alert was dismissed as “Used in tests”.
⬜ The alert came from a test run of default setup.

A pull request changes two lines in a function. CodeQL finds a data-flow alert whose path runs through those lines and three unchanged lines. Is the alert shown on the pull request?

⬜ No; alerts appear on a pull request only if all lines they identify are in the diff.
⬜ Yes, because part of the path is in the diff.
⬜ Yes, but only as a warning annotation.
⬜ Only if the alert’s severity is Error.

An organization with Code Security, but no Copilot licenses, uses CodeQL default setup. Which statements about Copilot Autofix are correct? (select two)

⬜ It is allowed by default and needs no separate enablement beyond CodeQL code scanning.
⬜ Enterprise, organization and repository administrators can disable it.
⬜ Each suggested fix consumes AI credits.
⬜ It works only with advanced setup.
⬜ It requires each user to have a Copilot license.

A developer assigns a code scanning alert from a security-extended query to Copilot cloud agent. How reliable is the fix check?

⬜ Copilot re-runs CodeQL with the code-scanning suite, so it can’t confirm fixes for security-extended or custom queries.
⬜ Copilot re-runs exactly the query that raised the alert.
⬜ Copilot doesn’t validate fixes; it opens the pull request straight away.
⬜ Copilot only proposes fixes for alerts from third-party tools.

Which events trigger a CodeQL scan with default setup? (select two)

⬜ A push to the default branch or a protected branch
⬜ A pull request against the default branch from a branch in the same repository
⬜ A pull request from a fork
⬜ A push to any feature branch
⬜ A new release being published

An organization wants every repository using default setup to apply a shared CodeQL configuration file from a central repository. One repository uses advanced setup with its own config-file input. What happens?

⬜ Set the github-codeql-config-file property; the advanced setup’s own config-file input still wins.
⬜ Set the property; it overrides the advanced setup’s config-file too.
⬜ Default setup can’t use configuration files, so every repository must move to advanced setup.
⬜ Add the file under .github/codeql/ in the organization’s .github repository; default setup reads it.

An analysis fails with: Error: "No source code was seen during the build". What does this indicate?

⬜ CodeQL couldn’t monitor the code, for example because there is no analyzable code in a detected language.
⬜ The runner ran out of disk space during extraction.
⬜ The SARIF file was larger than the upload limit.
⬜ The workflow is missing the security-events: write permission.

A team needs more information to debug a CodeQL workflow. What can they do? (select two)

⬜ Set ACTIONS_STEP_DEBUG to true as a secret or variable, then re-run.
⬜ Create CodeQL debugging artifacts, which upload as artifacts starting with debug-artifacts.
⬜ Set CODEQL_VERBOSE=1 in the repository’s dependabot.yml.
⬜ Enable delegated alert dismissal.
⬜ Change the query suite to security-and-quality.

An advanced setup workflow lists languages: java-kotlin, python, javascript-typescript directly in the “Initialize CodeQL” step, and analysis is slow. What change helps most?

⬜ Use a language matrix, so each language is analyzed in a parallel job.
⬜ Switch the query suite from default to security-extended.
⬜ Add on.pull_request.paths-ignore for all source folders.
⬜ Set build-mode: manual for Python.

Domain 5: Security operations: best practices, prioritization, and remediation (15–20%)

A branch ruleset uses Require code scanning results with CodeQL as a required tool. When does it prevent a pull request from merging? (select three)

⬜ CodeQL finds an alert at or above the severity set in the ruleset.
⬜ The CodeQL analysis is still in progress.
⬜ CodeQL isn’t configured for the repository.
⬜ The pull request has any open Dependabot alert.
⬜ The pull request was opened by a user without write access.
⬜ The repository has dismissed alerts in the last 30 days.

A repository has code scanning merge protection in a ruleset. Which pull requests or merges does that protection not apply to? (select two)

⬜ Merge queue groups
⬜ Dependabot pull requests analyzed by default setup
⬜ Pull requests from forks analyzed by advanced setup
⬜ Pull requests that change only Markdown files
⬜ Pull requests opened by organization owners

A security lead wants merges blocked only for CodeQL alerts with a security severity of High or Critical, ignoring non-security alerts. How should the tool be configured in the ruleset?

⬜ Security alerts set to High or higher, and Alerts set to None
⬜ Alerts set to Errors, and Security alerts set to Critical
⬜ Alerts set to All, and Security alerts set to None
⬜ Security alerts set to Medium or higher, and Alerts set to Errors and Warnings

A repository admin adds a Require code scanning results rule for CodeQL, but the repository has never had code scanning configured. What effect does the rule have?

⬜ Pull requests are blocked, because the required tool isn’t configured; the rule doesn’t enable scanning.
⬜ The rule enables CodeQL default setup automatically.
⬜ The rule is ignored until code scanning is enabled.
⬜ The rule converts to a required status check named “CodeQL”.

An organization on GitHub Team wants one ruleset that applies code scanning merge protection to every repository. What is the constraint?

⬜ Organization-level code scanning merge protection rulesets need a GitHub Enterprise plan; on Team, configure them per repository.
⬜ Organization rulesets are available on Team, but only for public repositories.
⬜ Merge protection must be set with the REST API on Team plans.
⬜ Team plans can only use the security-extended suite in rulesets.

A security team wants rulesets to keep leaked secrets and vulnerable code out of the default branch. Which branch ruleset rules enforce this? (select two)

⬜ Require code scanning results with alert thresholds
⬜ Require secret scanning alerts are resolved for selected secret types
⬜ A rule that runs a custom pattern dry run on each pull request
⬜ A rule that requires Copilot Autofix to approve each pull request
⬜ A rule that runs the secret risk assessment on every push

An AppSec lead plans a security campaign. Which limits apply? (select two)

⬜ A campaign can include at most 1,000 alerts.
⬜ An organization can have up to 10 active campaigns.
⬜ A campaign can include at most 100 repositories.
⬜ A campaign must end within 30 days.
⬜ Only one campaign can be open per repository.

A security manager tries to make an engineering manager, who has the maintain role on the repositories, the campaign manager. The engineering manager isn’t offered. Why?

⬜ Campaign managers must be organization owners or security managers.
⬜ Campaign managers must have admin access to every included repository.
⬜ Campaign managers must belong to a team that owns the repositories.
⬜ Only the campaign’s creator can be its manager.

An organization publishes one code scanning campaign and one secret scanning campaign. Who is notified about each?

⬜ Code campaign: anyone with write access to included repositories. Secret campaign: anyone who can view the alert list.
⬜ Both: only the campaign managers and repository admins.
⬜ Both: anyone with read access to included repositories.
⬜ Code campaign: commit authors of affected lines. Secret campaign: the secret’s owner.

When publishing a campaign, the lead wants a tracking issue created in every included repository. What applies?

⬜ The “Create issues for NUMBER repositories in this campaign” automation is available for code campaigns.
⬜ The option is available only for secret campaigns.
⬜ Issues are always created for every campaign type.
⬜ Issues must be created with a separate GitHub Actions workflow.

A campaign should target open Java log injection alerts in application code only, not test or library code. Which filter fits?

⬜

is:open autofilter:true rule:java/log-injection

⬜

is:open label:application rule:java/log-injection

⬜

state:open path:src/** cwe:117

⬜

is:open severity:critical language:java

A code campaign with 600 alerts is published on a Monday morning. What happens with Copilot Autofix?

⬜ All alerts are submitted to Copilot Autofix as capacity allows; most suggestions are ready within an hour.
⬜ Autofix suggestions appear only when a developer opens each alert.
⬜ Autofix runs only for alerts with Critical security severity.
⬜ Autofix suggestions take priority over pull request alerts until the campaign finishes.

A campaign manager assigns a secret scanning alert to a developer with write access who can’t normally view the repository’s secret alert list. What happens?

⬜ The developer’s permissions are raised for that alert, and revoked when they are unassigned.
⬜ The assignment fails until a repository admin grants access to the alert list.
⬜ The developer receives a redacted alert without the secret.
⬜ The alert is moved into a repository the developer administers.

A team uses alert assignees to show ownership of code scanning and secret scanning alerts. Which statements are correct? (select two)

⬜ An alert can be assigned to any user with write access to the repository.
⬜ GitHub notifies assignees when they are assigned and when the alert is dismissed.
⬜ An alert can only be assigned to the commit author.
⬜ Assignees automatically get the security manager role.
⬜ Assignments can only be made inside a security campaign.

A team links code scanning alerts to issues in a central tracking repository. Which statements are correct? (select two)

⬜ Each alert can link to one issue, and each issue can track up to 50 alerts.
⬜ When the alert closes after a fix, the linked issue stays open until someone closes it.
⬜ Closing the issue dismisses the linked alert.
⬜ Issues must be in the repository where the alert was found.
⬜ Deleting the issue deletes the alert.

A security manager wants developers to request approval before dismissing code scanning alerts, across all repositories in the organization. What is the documented approach?

⬜ Set “Prevent direct alert dismissals” to Enabled under code scanning in a custom security configuration, then apply it.
⬜ Add a codeql-config.yml key that blocks dismissals.
⬜ Remove write access from developers so they can’t dismiss alerts.
⬜ Create a ruleset with “Require dismissal approval”.

An enterprise owner opens the enterprise Security and quality tab to review a code scanning dismissal request from one organization, but can’t act on it. What is missing?

⬜ The owner must be an organization owner or security manager for that organization, or have a custom role with the permissions.
⬜ Enterprise owners must first turn on delegated dismissal in enterprise policies.
⬜ Requests can only be reviewed by the repository admin.
⬜ The request has to be escalated by the requester.

An organization creates a custom role for AppSec reviewers. They should approve developers’ code scanning dismissal requests and also dismiss alerts themselves without filing requests. Which permissions should the role include? (select two)

⬜ Review code scanning alert dismissal requests
⬜ Bypass code scanning alert dismissal requests
⬜ View code scanning alert dismissal requests only
⬜ Review and manage secret scanning bypass requests
⬜ Manage organization Actions secrets

A custom query suite file selects queries from a CodeQL pack. Which definition is valid?

⬜

- queries: src/security
  from: octo-org/java-queries
  version: ^1.2.0
- exclude:
    tags contain: experimental

⬜

- exclude:
    tags contain: experimental

⬜

- queries: src\security
  from: octo-org/java-queries

⬜

queries:
  path: src/security
  pack: octo-org/java-queries
  exclude: experimental

A query suite locates all queries in a pack, then lists include for high-precision queries followed by exclude for experimental ones. How is the selection built?

⬜ Starting with include means only matching queries are kept; the later exclude then removes experimental ones.
⬜ All located queries are kept, and only exclude has an effect.
⬜ exclude always runs first, regardless of order.
⬜ The last instruction alone decides the result.

A suite uses - qlpack: octo-org/legacy-queries, and that pack doesn’t define a default suite. What gets selected?

⬜ All queries in the pack
⬜ No queries, and the analysis fails
⬜ Only queries tagged security
⬜ The security-extended suite from the pack’s language

Which statements correctly describe CodeQL pack types? (select two)

⬜ Query packs contain precompiled queries and are designed to be run.
⬜ Model packs expand analysis to recognize libraries and frameworks not supported by default.
⬜ Library packs contain queries that run automatically in default setup.
⬜ Model packs replace the need for a qlpack.yml file.
⬜ Query packs can’t declare dependencies on other packs.

A Go service relies on an in-house HTTP framework that CodeQL doesn’t recognize. The team plans to write a CodeQL model pack. What is the problem?

⬜ Model packs aren’t supported for Go; they cover C/C++, C#, Java/Kotlin, Python, Ruby and Rust.
⬜ Model packs work only with the CodeQL CLI, not code scanning.
⬜ Model packs require the security-and-quality suite.
⬜ Model packs can only be published to npm.

A team wants default setup to use a CodeQL model pack for an internal Java framework. Which statements are correct? (select two)

⬜ For one repository, put the model pack directory in .github/codeql/extensions, where it is detected automatically.
⬜ For all repositories in an organization, publish the pack to GitHub Container registry and list it in organization settings.
⬜ Default setup can’t use model packs, so advanced setup is required.
⬜ The pack must be in the .github repository of the organization.
⬜ Model packs in .github/codeql/extensions stop working if the repository moves to advanced setup.

A Java batch job reads untrusted data from environment variables and files, not from network requests. How can CodeQL treat those inputs as tainted?

⬜ Use the local threat model, for example threat-models: local in a configuration file, or Remote and local sources in default setup.
⬜ Switch to the security-and-quality suite, which includes local sources.
⬜ Set build-mode: manual.
⬜ Add the environment variable names to paths.

A team wants the security-extended suite, minus queries tagged cwe-020, set inline in the workflow without a separate file. Which init step does this?

⬜

- uses: github/codeql-action/init@v4
  with:
    languages: java-kotlin
    config: |
      queries:
        - uses: security-extended
      query-filters:
        - exclude:
            tags: /cwe-020/

⬜

- uses: github/codeql-action/init@v4
  with:
    languages: java-kotlin
    queries: security-extended
    exclude-tags: cwe-020

⬜

- uses: github/codeql-action/init@v4
  with:
    languages: java-kotlin
    config-file: |
      queries: security-extended -cwe-020

⬜

- uses: github/codeql-action/analyze@v4
  with:
    query-filters: exclude cwe-020
    queries: security-extended

A security team wants one extra query pack run in every repository’s CodeQL analysis, including default setup, without editing workflows. What can they use?

⬜ The github-codeql-extra-queries repository property
⬜ The github-codeql-disable-overlay repository property
⬜ A security-and-quality query suite selection in default setup
⬜ The paths key in each repository’s configuration file

A team wants only its own custom CodeQL queries to run, not GitHub’s default security queries. Which configuration file key does this?

⬜ disable-default-queries: true
⬜ queries: none
⬜ query-filters: exclude: default
⬜ threat-models: custom

An AppSec manager wants to focus on alerts that affect artifacts actually running in production. Which statements are correct? (select two)

⬜ artifact-registry-url and artifact-registry filters use storage records sent to the linked artifacts page.
⬜ has:deployment AND runtime-risk:internet-exposed finds alerts in deployed, internet-facing code.
⬜ Production context is gathered from the dependency graph automatically, with no records needed.
⬜ Production filters work only for secret scanning alerts.
⬜ artifact-registry:jfrog-artifactory needs a custom pattern to work.

A developer dismisses a CodeQL alert on a feature branch. Why does choosing the right dismissal reason matter?

⬜ The alert is dismissed in all branches, and the reason may affect whether the query keeps running in future analyses.
⬜ The alert is dismissed only on that branch, so the reason is just for reporting.
⬜ The reason decides who can reopen the alert.
⬜ Only “Won’t fix” dismissals are recorded in the timeline.

An auditor wants a history of code scanning alert status changes from the organization audit log. What should they know?

⬜ Code scanning doesn’t create timeline events in the audit log; use alert timelines, the API or webhooks.
⬜ Code scanning events are logged only for dismissals.
⬜ Code scanning events appear only after audit log streaming is configured.
⬜ Code scanning events are logged in the enterprise audit log but not in the organization’s.

A script polls the REST API to report how long each secret scanning alert stayed open before it was resolved. Why will this be hard?

⬜ The API reports only an alert’s current status, so earlier state changes aren’t returned.
⬜ The API doesn’t expose secret scanning alerts.
⬜ The API only lists alerts from the last 90 days.
⬜ The API requires the alert to be reopened before it can be read.

A SOC wants a Slack message whenever someone bypasses push protection. Which webhook setup fits?

⬜ Subscribe to secret_scanning_alert events and act on payloads where push_protection_bypassed is true.
⬜ Subscribe to code_scanning_alert events with tool.name set to push-protection.
⬜ Subscribe to dependabot_alert events with state set to bypassed.
⬜ Subscribe to repository_ruleset events.

Which statements about the security manager role are correct? (select two)

⬜ It grants read access to all repositories in the organization, in addition to existing access.
⬜ It grants write access to all security alerts in the organization.
⬜ It grants admin access to all repositories.
⬜ It can only be assigned to teams, not individual members.
⬜ It can only be assigned by enterprise owners.

A risk-based campaign should cover open secret scanning alerts only in repositories marked as urgent with a custom property. Which filter fits?

⬜

is:open props.BusinessPriority:Urgent

⬜

is:open topic:urgent secret-type:all

⬜

is:open severity:urgent

⬜

is:open custom.BusinessPriority=Urgent

A team wants to stop vulnerable dependencies entering the codebase, not just find them afterwards. Which feature shifts this check left?

⬜ Dependency review on pull requests
⬜ Dependabot alerts on the default branch
⬜ SBOM export from the dependency graph
⬜ Security overview’s Dependabot view

Every repository security advisory published on GitHub may become a global advisory. Who decides?

⬜ The GitHub Security Lab curation team reviews each repository advisory for inclusion as a global advisory.
⬜ The repository owner publishes it to the GitHub Advisory Database directly.
⬜ The National Vulnerability Database chooses which ones to import.
⬜ Advisories become global automatically once they have a CVE.

Domain 6: GitHub Security suites administration (10–15%)

An organization owner sets a custom security configuration as the default for new repositories. Which statements are correct? (select two)

⬜ The default can target Public, Private and internal, or All repositories.
⬜ A repository transferred into the organization doesn’t get the default; it has to be applied manually.
⬜ The default is also applied to every existing repository that has no configuration.
⬜ The default can only target public repositories.
⬜ Forks created from organization repositories always get the default.

An enforced configuration enables secret scanning and push protection, but leaves Dependabot security updates as “keep existing setting”. What can a repository admin change?

⬜ Dependabot security updates, but not secret scanning or push protection
⬜ Nothing; enforcement locks every security setting in the repository
⬜ All settings, because enforcement only applies to new repositories
⬜ Push protection only, because bypass settings are excluded from enforcement

An enterprise owner wants an enterprise-level security configuration that organization owners can’t loosen either. What does enterprise enforcement allow?

⬜ Enforcing for repository owners only, or for both repository and organization owners
⬜ Enforcing for organization owners only, leaving repository owners free
⬜ Enforcing only on public repositories
⬜ Enforcement is available only at the organization level

An enforced configuration enables code scanning default setup, yet some repositories aren’t being scanned. Which situations can break enforcement? (select two)

⬜ GitHub Actions was enabled on the repository and later disabled.
⬜ The actions required by the code scanning configuration aren’t available in the repository.
⬜ The repository was renamed after the configuration was applied.
⬜ The repository has more than 1,000 open alerts.
⬜ A developer committed a CodeQL workflow file.

A script calls the REST API to disable secret scanning on a repository covered by an enforced security configuration. What happens?

⬜ The call appears to succeed, but the enablement status doesn’t change.
⬜ The call returns 403 Forbidden, citing enforcement.
⬜ The call succeeds and the configuration status changes to removed.
⬜ The call detaches the configuration from the repository.

Which statements about the removed and detached configuration statuses are correct? (select two)

⬜ removed means a repository admin changed a setting on an unenforced configuration; the configuration is still associated.
⬜ detached means no configuration manages the repository, and its existing settings are unchanged.
⬜ removed repositories still count toward the configuration’s coverage metrics.
⬜ detached repositories have all security features turned off.
⬜ removed can only be cleared by an enterprise owner.

After applying a configuration, several repositories show “Failed” in the repository table. What is the recommended next step?

⬜ Filter with config-status:failed, then follow the remediation guidance for each repository.
⬜ Wait; failed is a transient state that clears itself.
⬜ Delete and recreate the configuration.
⬜ Ask GitHub Support to force-attach the configuration.

An auditor wants a record of every security configuration status change across the organization. Where should they look?

⬜ The organization audit log, searching action:repository_security_configuration
⬜ The secret_scanning_alert webhook
⬜ The security overview Risk view
⬜ The repository’s Insights tab

An organization applies a security configuration to all repositories, including archived ones. Why does GitHub apply it to archived repositories?

⬜ Some features, such as secret scanning, run on archived repositories, and the repository stays protected if it is unarchived.
⬜ Archived repositories are billed differently and need a configuration to stop charges.
⬜ Code scanning default setup scans archived repositories weekly.
⬜ Applying to archived repositories is optional and off by default.

Some repositories already run CodeQL with advanced setup workflows. The organization wants one configuration for every repository without overriding those workflows. Which default setup option fits?

⬜ “Enabled with advanced setup allowed”
⬜ “Enabled”
⬜ “Not set”
⬜ “Disabled”

A custom security configuration enables Code Security and the dependency graph. Which extra capability does that combination turn on?

⬜ Dependency review
⬜ Push protection
⬜ Validity checks
⬜ Private vulnerability reporting

On GitHub Enterprise Cloud, who can create custom security configurations at the enterprise level?

⬜ Enterprise owners and enterprise members with the admin role
⬜ Any organization owner in the enterprise
⬜ Security managers of any organization
⬜ Billing managers

An enterprise policy allows GitHub Code Security in an organization, but GitHub Actions isn’t available there. What happens to code scanning?

⬜ It can’t run, even though the policy makes it available.
⬜ It runs on GitHub-hosted runners outside the Actions policy.
⬜ It falls back to scanning with the CodeQL CLI on GitHub servers.
⬜ It runs only for public repositories.

An enterprise owner allows repository admins to manage AI detection for secret scanning, but repository admins can’t enable it. Which other policy setting is likely blocking them?

⬜ “Repository administrators can enable or disable Secret Protection” is not allowed.
⬜ The Copilot Autofix policy is set to “Not allowed”.
⬜ The dependency insights policy is restricted.
⬜ The AI Scan policy is “Not allowed”.

Which statements about enterprise code security policies are correct? (select two)

⬜ The Copilot Autofix policy only takes effect when GitHub Code Security is enabled for the organization.
⬜ Secret scanning of GitHub Actions workflow logs is disabled by default and is turned on by an enterprise owner.
⬜ Secret scanning of workflow logs rescans all past workflow runs once enabled.
⬜ The Copilot Autofix policy also controls fixes for Dependabot alerts.
⬜ Workflow log scanning also detects custom patterns and AI-detected secrets.

An enterprise sets the Copilot Autofix policy so repository admins can’t enable it. Which results does that affect?

⬜ Fixes for code scanning security query results only
⬜ Fixes for both code scanning and GitHub Code Quality findings
⬜ Fixes for Dependabot alerts
⬜ Fixes for secret scanning alerts

A GitHub Enterprise Server admin enables Advanced Security features through infrastructure-as-code using the administrative shell. Which commands are correct? (select two)

⬜

ghe-config app.minio.enabled true
ghe-config app.code-scanning.enabled true

⬜

ghe-config app.secret-scanning.enabled true

⬜

ghe-config app.advanced-security.enabled true

⬜

gh api -X PATCH /enterprises/ENTERPRISE/code-security --enable

⬜

ghe-config app.push-protection.users true

An organization owner on GitHub Enterprise Server builds a security configuration. Which statements describe GitHub Enterprise Server behavior? (select two)

⬜ Only features a site administrator has installed on the instance appear in the UI.
⬜ Dependabot security updates and code scanning default setup also need GitHub Actions installed on the instance.
⬜ All features appear, but greyed out until licensed.
⬜ Code scanning default setup can run without GitHub Actions on the instance.
⬜ Security configurations aren’t available on GitHub Enterprise Server.

A GitHub Enterprise Server site admin enables Code Security and Secret Protection for the instance. What can repository administrators do next?

⬜ Enable the features in all organizations, unless an enterprise policy restricts it
⬜ Nothing until each organization buys its own license
⬜ Only view alerts; site admins must enable each repository
⬜ Enable them only in repositories created after the change

An organization wants repositories enabling default setup to be nudged towards broader CodeQL coverage. Which global setting fits?

⬜ Recommend the extended query suite for repositories enabling default setup
⬜ Expanding CodeQL analysis with the security-and-quality suite
⬜ Enforce configuration on the default setup option
⬜ Keep scheduled scans running every 30 days

A repository using default setup has had no push or pull request scans for 200 days. What happens to its scheduled scans, and what can the organization change?

⬜ Weekly scans stop; an owner can select Keep scheduled scans running every 30 days for inactive repositories, with a fixed period.
⬜ Weekly scans continue; the organization can shorten them to daily.
⬜ Default setup is disabled; it must be re-enabled per repository.
⬜ Scans move to monthly automatically, and the period can be set per repository.

An owner grants Dependabot access to a private repository of shared libraries in organization Global settings. What should they be aware of?

⬜ Every user in the organization can access that repository’s contents through Dependabot updates.
⬜ Only repository admins can trigger Dependabot updates that use it.
⬜ The repository becomes internal.
⬜ Dependabot can then also write to that repository.

An organization applies a configuration that enables default setup, but one repository stays ineligible. Which reason could explain it?

⬜ The repository already has advanced setup for code scanning enabled.
⬜ The repository has a dependabot.yml file.
⬜ The repository is public.
⬜ The repository uses secret scanning custom patterns.

Fifty Java repositories need the same CodeQL advanced setup because default setup can’t build them. What approach do the docs describe?

⬜ Test one workflow, then use a bulk script, such as the advanced-security/gh-add-files GitHub CLI extension, to add it to each repository.
⬜ Apply a security configuration with “Advanced setup” selected.
⬜ Enable advanced setup in organization Global settings.
⬜ Put the workflow in the organization’s .github repository so it’s inherited.

An enterprise owner who isn’t an owner or security manager of any organization opens the enterprise security overview. Which statements are correct? (select two)

⬜ They see aggregated data only for organizations where they are an organization owner or security manager.
⬜ Views show data for the default branches of repositories they can view.
⬜ Enterprise owners see repository-level details in every organization automatically.
⬜ Views show data for all branches.
⬜ The overview includes alerts from repositories where the feature isn’t enabled.

An enterprise disables push protection for a noisy provider pattern in its pattern configuration. Can an organization re-enable it?

⬜ Yes; organization administrators and security teams can override enterprise-level pattern settings.
⬜ No; enterprise pattern settings are always enforced.
⬜ Only if the organization defines a custom pattern with the same regex.
⬜ Only by contacting GitHub Support.