Last GH-500 practice test reviews: Practice Test Microsoft dumps
Try GH-500 Free Now! Real Exam Question Answers Updated [Dec 09, 2025]
Microsoft GH-500 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 17
Which Dependabot configuration fields are required? (Each answer presents part of the solution. Choose three.)
- A. schedule.interval
- B. milestone
- C. directory
- D. allow
- E. package-ecosystem
Answer: A,C,E
Explanation:
Comprehensive and Detailed Explanation:
When configuring Dependabot via the dependabot.yml file, the following fields are mandatory for each update configuration:
directory: Specifies the location of the package manifest within the repository. This tells Dependabot where to look for dependency files.
package-ecosystem: Indicates the type of package manager (e.g., npm, pip, maven) used in the specified directory.
schedule.interval: Defines how frequently Dependabot checks for updates (e.g., daily, weekly). This ensures regular scanning for outdated or vulnerable dependencies.
The milestone field is optional and used for associating pull requests with milestones. The allow field is also optional and used to specify which dependencies to update.
GitLab
NEW QUESTION # 18
How many alerts are created when two instances of the same secret value are in the same repository?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.
This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.
NEW QUESTION # 19
What are Dependabot security updates?
- A. Automated pull requests that keep your dependencies updated, even when they don't have any vulnerabilities
- B. Compatibility scores to let you know whether updating a dependency could cause breaking changes to your project
- C. Automated pull requests that help you update dependencies that have known vulnerabilities
- D. Automated pull requests to update the manifest to the latest version of the dependency
Answer: C
Explanation:
Dependabot security updates are automated pull requests triggered when GitHub detects a vulnerability in a dependency listed in your manifest or lockfile. These PRs upgrade the dependency to the minimum safe version that fixes the vulnerability.
This is separate from regular updates (which keep versions current even if not vulnerable).
NEW QUESTION # 20
What happens when you enable secret scanning on a private repository?
- A. GitHub performs a read-only analysis on the repository.
- B. Your team is subscribed to security alerts.
- C. Dependency review, secret scanning, and code scanning are enabled.
- D. Repository administrators can view Dependabot alerts.
Answer: A
Explanation:
When secret scanning is enabled on a private repository, GitHub performs a read-only analysis of the repository's contents. This includes the entire Git history and files to identify strings that match known secret patterns or custom-defined patterns.
GitHub does not alter the repository, and enabling secret scanning does not automatically enable code scanning or dependency review - each must be configured separately.
NEW QUESTION # 21
Which alerts do you see in the repository's Security tab? (Each answer presents part of the solution. Choose three.)
- A. Secret scanning alerts
- B. Dependabot alerts
- C. Code scanning alerts
- D. Security status alerts
- E. Repository permissions
Answer: A,B,C
Explanation:
In a repository's Security tab, you can view:
Secret scanning alerts: Exposed credentials or tokens
Dependabot alerts: Vulnerable dependencies from the advisory database
Code scanning alerts: Vulnerabilities in code detected via static analysis (e.g., CodeQL) You won't see general "security status alerts" (not a formal category) or permission-related alerts here.
NEW QUESTION # 22
What does a CodeQL database of your repository contain?
- A. A build of the code and extracted data
- B. A representation of all of the source code
- C. Build commands for C/C++, C#, and Java
- D. A build for Go projects to set up the project
Answer: A
Explanation:
GitHub
Agentic AI for AppSec Teams
Explanation:
Comprehensive and Detailed Explanation:
A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.
GitHub Docs
NEW QUESTION # 23
Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabled? (Each answer presents part of the solution. Choose two.)
- A. It generates a Dependabot alert and displays it on the Security tab for the repository.
- B. It generates Dependabot alerts by default for all private repositories.
- C. It notifies the repository administrators about the new alert.
- D. It consults with a security service and conducts a thorough vulnerability review.
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation:
When GitHub identifies a vulnerable dependency in a repository with Dependabot alerts enabled, it performs the following actions:
Generates a Dependabot alert: The alert is displayed on the repository's Security tab, providing details about the vulnerability and affected dependency.
Notifies repository maintainers: By default, GitHub notifies users with write, maintain, or admin permissions about new Dependabot alerts.
GitHub Docs
These actions ensure that responsible parties are informed promptly to address the vulnerability.
NEW QUESTION # 24
What is required to trigger code scanning on a specified branch?
- A. The workflow file must exist in that branch.
- B. Secret scanning must be enabled on the repository.
- C. Developers must actively maintain the repository.
- D. The repository must be private.
Answer: A
Explanation:
Comprehensive and Detailed Explanation:
For code scanning to be triggered on a specific branch, the branch must contain the appropriate workflow file, typically located in the .github/workflows directory. This YAML file defines the code scanning configuration and specifies the events that trigger the scan (e.g., push, pull_request).
Without the workflow file in the branch, GitHub Actions will not execute the code scanning process for that branch. The repository's visibility (private or public), the status of secret scanning, or the activity level of developers do not directly influence the triggering of code scanning.
NEW QUESTION # 25
Who can fix a code scanning alert on a private repository?
- A. Users who have Read permissions within the repository
- B. Users who have the security manager role within the repository
- C. Users who have the Triage role within the repository
- D. Users who have Write access to the repository
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
In private repositories, users with write access can fix code scanning alerts. They can do this by committing changes that address the issues identified by the code scanning tools. This level of access ensures that only trusted contributors can modify the code to resolve potential security vulnerabilities.
GitHub Docs
Users with read or triage roles do not have the necessary permissions to make code changes, and the security manager role is primarily focused on managing security settings rather than directly modifying code.
Reference:
GitHub Docs
NEW QUESTION # 26
Which security feature shows a vulnerable dependency in a pull request?
- A. Dependency review
- B. Dependency graph
- C. The repository's Security tab
- D. Dependabot alert
Answer: A
Explanation:
Dependency review runs as part of a pull request and shows which dependencies are being added, removed, or changed - and highlights vulnerabilities associated with any added packages.
It works in real-time and is specifically designed for use during pull request workflows.
The dependency graph is an overview, Dependabot alerts notify post-merge, and the Security tab shows the aggregated alert list.
NEW QUESTION # 27
Where can you view code scanning results from CodeQL analysis?
- A. A CodeQL query pack
- B. A CodeQL database
- C. At Security advisories
- D. The repository's code scanning alerts
Answer: D
Explanation:
All results from CodeQL analysis appear under the repository's code scanning alerts tab. This section is part of the Security tab and provides a list of all current, fixed, and dismissed alerts found by CodeQL.
A CodeQL database is used internally during scanning but does not display results. Query packs contain rules, not results. Security advisories are for published vulnerabilities, not per-repo findings.
NEW QUESTION # 28
Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?
- A. Enable by default for new public repositories
- B. Enable all in existing repositories
- C. Enable all for Dependency graph
- D. Enable all for Dependabot alerts
Answer: D
Explanation:
To ensure you're notified whenever a vulnerability is detected via Dependabot, you must enable alerts for Dependabot in your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.
The dependency graph must be enabled for scanning, but does not send alerts itself.
NEW QUESTION # 29
Which of the following Watch settings could you use to get Dependabot alert notifications? (Each answer presents part of the solution. Choose two.)
- A. The Ignore setting
- B. The Participating and @mentions setting
- C. The All Activity setting
- D. The Custom setting
Answer: C,D
Explanation:
Comprehensive and Detailed Explanation:
To receive Dependabot alert notifications for a repository, you can utilize the following Watch settings:
Custom setting: Allows you to tailor your notifications, enabling you to subscribe specifically to security alerts, including those from Dependabot.
All Activity setting: Subscribes you to all notifications for the repository, encompassing issues, pull requests, and security alerts like those from Dependabot.
The Participating and @mentions setting limits notifications to conversations you're directly involved in or mentioned, which may not include security alerts. The Ignore setting unsubscribes you from all notifications, including critical security alerts.
GitHub Docs
+1
GitHub Docs
+1
NEW QUESTION # 30
Which details do you have to provide to create a custom pattern for secret scanning? (Each answer presents part of the solution. Choose two.)
- A. The name of the pattern
- B. Additional match requirements for the secret format
- C. A list of repositories to scan
- D. The secret format
Answer: A,D
Explanation:
When defining a custom pattern for secret scanning, two key fields are required:
Name of the pattern: A unique label to identify the pattern
Secret format: A regular expression that defines what the secret looks like (e.g., token format) You can optionally specify additional match requirements (like required context keywords), but they're not mandatory. Listing repositories is also not part of the required fields during pattern creation.
NEW QUESTION # 31
A dependency has a known vulnerability. What does the warning message include?
- A. The security impact of these changes
- B. A brief description of the vulnerability
- C. How many projects use these components
- D. An easily understandable visualization of dependency change
Answer: B
Explanation:
When a vulnerability is detected, GitHub shows a warning that includes a brief description of the vulnerability. This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.
This helps developers understand the context and urgency of the vulnerability before applying the fix.
NEW QUESTION # 32
After investigating a code scanning alert related to injection, you determine that the input is properly sanitized using custom logic. What should be your next step?
- A. Dismiss the alert with the reason "false positive."
- B. Draft a pull request to update the open-source query.
- C. Ignore the alert.
- D. Open an issue in the CodeQL repository.
Answer: A
Explanation:
When you identify that a code scanning alert is a false positive-such as when your code uses a custom sanitization method not recognized by the analysis-you should dismiss the alert with the reason "false positive." This action helps improve the accuracy of future analyses and maintains the relevance of your security alerts.
As per GitHub's documentation:
"If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the CodeQL repository and improving the analysis." By dismissing the alert appropriately, you ensure that your codebase's security alerts remain actionable and relevant.
NEW QUESTION # 33
A repository's dependency graph includes:
- A. A summary of the dependencies used in your organization's repositories.
- B. Annotated code scanning alerts from your repository's dependencies.
- C. Dependencies from all your repositories.
- D. Dependencies parsed from a repository's manifest and lock files.
Answer: D
Explanation:
The dependency graph in a repository is built by parsing manifest and lock files (like package.json, pom.xml, requirements.txt). It helps GitHub detect dependencies and cross-reference them with known vulnerability databases for alerting.
It is specific to each repository and does not show org-wide or cross-repo summaries.
NEW QUESTION # 34
What role is required to change a repository's code scanning severity threshold that fails a pull request status check?
- A. Maintain
- B. Write
- C. Triage
- D. Admin
Answer: D
Explanation:
To change the threshold that defines whether a pull request fails due to code scanning alerts (such as blocking merges based on severity), the user must have Admin access on the repository. This is because modifying these settings falls under repository configuration privileges.
Users with Write, Maintain, or Triage roles do not have the required access to modify rulesets or status check policies.
NEW QUESTION # 35
As a developer, you need to configure a code scanning workflow for a repository where GitHub Advanced Security is enabled. What minimum repository permission do you need?
- A. Admin
- B. Write
- C. Read
- D. None
Answer: B
Explanation:
To create or modify a code scanning workflow file (typically under .github/workflows/codeql-analysis.yml), you must have Write access to the repository.
Write permission allows you to commit the workflow file, which is required to run or configure code scanning using GitHub Actions.
NEW QUESTION # 36
Which key is required in the update settings of the Dependabot configuration file?
- A. assignees
- B. rebase-strategy
- C. commit-message
- D. package-ecosystem
Answer: D
Explanation:
In a dependabot.yml configuration file, package-ecosystem is a required key. It defines the package manager being used in that update configuration (e.g., npm, pip, maven, etc.).
Without this key, Dependabot cannot determine how to analyze or update dependencies. Other keys like rebase-strategy or commit-message are optional and used for customizing behavior.
NEW QUESTION # 37
If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?
- A. Users with Maintain privileges to the repository
- B. Users with Read permissions to the repository
- C. Users with Admin privileges to the repository
- D. Users with Write permissions to the repository
Answer: D
Explanation:
By default, users with Write, Maintain, or Admin permissions will receive notifications for new Dependabot alerts. However, Write permission is the minimum level needed to be automatically notified. Users with only Read access do not receive alerts unless added explicitly.
NEW QUESTION # 38
As a repository owner, you want to receive specific notifications, including security alerts, for an individual repository. Which repository notification setting should you use?
- A. Custom
- B. All Activity
- C. Ignore
- D. Participating and @mentions
Answer: A
Explanation:
Using the Custom setting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.
This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.
NEW QUESTION # 39
In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
- A. Dependency graph enabled at the organization level for all new private repositories
- B. Read-only access to the dependency manifest and lock files for a repository
- C. Write access to the dependency manifest and lock files for an enterprise
- D. Read-only access to all the repository's files
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation:
To generate a dependency graph for a private repository, GitHub requires:
Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.
Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
NEW QUESTION # 40
Which of the following steps should you follow to integrate CodeQL into a third-party continuous integration system? (Each answer presents part of the solution. Choose three.)
- A. Install the CLI
- B. Process alerts
- C. Write queries
- D. Analyze code
- E. Upload scan results
Answer: A,D,E
Explanation:
When integrating CodeQL outside of GitHub Actions (e.g., in Jenkins, CircleCI):
Install the CLI: Needed to run CodeQL commands.
Analyze code: Perform the CodeQL analysis on your project with the CLI.
Upload scan results: Export the results in SARIF format and use GitHub's API to upload them to your repo's security tab.
You don't need to write custom queries unless extending functionality. "Processing alerts" happens after GitHub receives the results.
NEW QUESTION # 41
What is a security policy?
- A. An alert about dependencies that are known to contain security vulnerabilities
- B. A security alert issued to a community in response to a vulnerability
- C. A file in a GitHub repository that provides instructions to users about how to report a security vulnerability
- D. An automatic detection of security vulnerabilities and coding errors in new or modified code
Answer: C
Explanation:
A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project's transparency and ensures timely communication and mitigation of any reported issues.
Adding this file also enables a "Report a vulnerability" button in the repository's Security tab.
NEW QUESTION # 42
......
Get Ready to Pass the GH-500 exam with Microsoft Latest Practice Exam : https://braindumps.actual4exams.com/GH-500-real-braindumps.html