GH-500 GitHub Advanced Security Exam Questions and Answers

By default, secret scanning is enabled automatically for all public repositories . For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.

This default behavior helps protect open-source projects without requiring additional configuration.

GitHub identifies repository administrators as users who can enable Dependabot alerts for an individual repository. Organization owners can also enable the feature at organization scope, but they are not one of the options presented. Once enabled, Dependabot compares dependency information against vulnerability data from the GitHub Advisory Database and generates alerts when affected dependencies are found. Users with Maintain or Write access can view and work with alerts when permissions allow, but enabling or disabling repository security features requires repository administration privileges under the configuration model tested here. Outside collaborators do not automatically receive that level of administrative control, and “security analyst” is not a standard repository role granting feature-enablement authority. Therefore, repository administrator is the correct selection.

GitHub documents a size limit for the .github/secret_scanning.yml configuration file. If the file is larger than 1 MB, secret scanning ignores the entire configuration file. This file is used primarily to define paths-ignore entries for directories or files where matching secrets should automatically be excluded or alerts closed as ignored by configuration. There is also a separate limit on path exclusions: if paths-ignore contains more than 1,000 entries, GitHub processes only the first 1,000 directories rather than ignoring the complete configuration file. Therefore, the 1,000-entry condition has different behavior from exceeding the file-size limit. A 100 KB file remains below GitHub's documented threshold. Consequently, option B accurately identifies the condition that causes the entire secret_scanning.yml file to be ignored.

Comprehensive and Detailed Explanation:

To generate a dependency graph for a private repository, GitHub requires:​

Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.​

Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.​

Dependency review and secret scanning are capabilities associated with GitHub Advanced Security. In GitHub's current product structure, dependency review is included with GitHub Code Security, while secret scanning is a central capability of GitHub Secret Protection. Both products are components of the broader GitHub Advanced Security offering, and legacy GHAS licenses can include the combined capabilities. The dependency graph is an important supply-chain feature and provides the underlying dependency inventory, but it is broadly available beyond the licensed GHAS feature set and is enabled by default for public repositories. A repository security policy, normally provided through SECURITY.md, is also a general repository capability rather than one of the licensed Advanced Security features being tested. Therefore, dependency review and secret scanning are the correct selections.

To systematically analyze newly introduced source code for security weaknesses, you should configure code scanning. GitHub code scanning can use CodeQL or supported third-party analysis tools and can run automatically when developers push changes or create pull requests. This places vulnerability detection directly into the development workflow rather than depending on manual review. The extended CodeQL query suite broadens the set of queries executed, but it only has an effect after code scanning itself is configured. CODEOWNERS determines who reviews specific paths and does not perform vulnerability analysis. A security policy explains how vulnerabilities should be reported but does not scan source code. Therefore, enabling and properly configuring code scanning is the foundational mechanism for ensuring new code is automatically analyzed.

By default, users with Write, Maintain, or Admin permissions will receive notifications for new Dependabot alerts . However, Write permission is the minimum level needed to be automatically notified. Users with only Read access do not receive alerts unless added explicitly.

If autobuild fails (which attempts to automatically detect how to build your project), you should disable it in your workflow and replace it with explicit build commands , using steps like run: make or run: ./gradlew build.

This ensures CodeQL can still extract and analyze the code correctly.

Code scanning merge requirements and severity thresholds are repository configuration controls and are therefore managed from the repository's Settings area. In GitHub's current interface, administrators can create a branch ruleset under Settings and configure Require code scanning results. They can then select the code scanning tool and specify alert thresholds, including which normal alerts or security-severity levels should prevent merging. The Security and quality tab is primarily where security findings are reviewed and triaged, while the Actions tab displays workflow execution information. The Pull Requests tab is used to review and merge proposed changes rather than configure repository-wide code scanning policy. Thus, although GitHub's implementation has evolved toward ruleset-based merge protection, the appropriate top-level location remains the repository's Settings tab.

A code scanning alert provides information that helps a developer identify and understand the security problem detected by the analysis tool. GitHub specifically displays the line of code that triggered the alert, together with properties such as severity, security severity, the nature of the problem, and when the issue was introduced. CodeQL-generated alerts may additionally contain remediation guidance and data-flow information. Secret values are handled through secret scanning rather than being shown as the defining detail of a code scanning alert. GitHub also does not list all users with repository Read access within an individual alert, and a CWE submission date is not the primary alert-location information. The source-code location is therefore the correct answer.

To detect and block vulnerable dependencies before merge , developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.

This is a preventative measure during development, unlike Dependabot, which reacts after the fact .

Comprehensive and Detailed Explanation:

When setting up CodeQL analysis for compiled languages, there are two primary methods to build your code:​

GitHub Docs

Autobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.​

GitHub Docs

Custom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.​

GitHub Docs

The init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.​

In a repository's Security tab, you can view:

Secret scanning alerts : Exposed credentials or tokens

Dependabot alerts : Vulnerable dependencies from the advisory database

Code scanning alerts : Vulnerabilities in code detected via static analysis (e.g., CodeQL)

You won’t see general "security status alerts" (not a formal category) or permission-related alerts here.

Secret scanning is a feature provided by GitHub that scans the contents of your GitHub repositories for known types of secrets, such as API keys and tokens. It operates within the GitHub environment and does not scan external systems, services, or repositories outside of GitHub. Its primary function is to prevent the accidental exposure of sensitive information within your GitHub-hosted code.​

A repository administrator can enable secret scanning for an eligible repository that is owned by the organization, assuming the organization's GitHub plan, Secret Protection licensing, and enterprise policies permit the feature. GitHub documentation states that secret scanning alerts can be enabled for organization-owned repositories, including eligible private and internal repositories. Repository administrators manage security settings for repositories over which they have the required administrative permission. They do not obtain administrative control over separate user-owned repositories merely because those users are organization members, nor can they configure repositories owned by users outside the organization. Organization owners can also enable secret scanning across multiple organization repositories through security configurations. Accordingly, the supported scope described by the question is existing private repositories owned by the administrator's organization.

Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.

This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.

Comprehensive and Detailed Explanation:

By default, users with write access to a repository have the ability to merge pull requests, including those created by Dependabot for security updates. This access level allows contributors to manage and integrate changes, ensuring that vulnerabilities are addressed promptly.​

Users with only read access cannot merge pull requests, and enterprise administrators do not automatically have merge rights unless they have write or higher permissions on the specific repository.​

You should dismiss a code scanning alert if the flagged code is not a true security concern , such as:

Code in test files

Code paths that are unreachable or safe by design

False positives from the scanner

Fixing the code would automatically resolve the alert — not dismiss it. Dismissing is for valid exceptions or noise reduction.

The command @dependabot ignore this dependency closes the current Dependabot pull request and creates an ignore condition that prevents Dependabot from opening additional pull requests for that dependency. The restriction remains until the pull request is reopened or the dependency is manually upgraded to the suggested version. @dependabot recreate performs the opposite action: it recreates the pull request and overwrites edits made to it. @dependabot rebase rebases the Dependabot pull request against the current target branch. GitHub does not document @dependabot close as the command for permanently suppressing the dependency update. GitHub also provides more granular commands to ignore only a major, minor, or patch version when permanent dependency-level suppression would be too broad.

In a CodeQL query suite, the query filename constraint matches the final path component—that is, the filename of the query file itself. GitHub distinguishes this from query path, which matches the path to the query relative to the enclosing CodeQL pack. The tags contain and tags contain all constraints operate on values from the query's @tags metadata rather than its filesystem path. tags contain requires one of the specified strings to match a tag component, while tags contain all requires all specified strings to be represented. Therefore, when the objective is specifically to filter queries according to the last component of their file path, query filename is the appropriate CodeQL query-suite constraint.

GitHub allows organization owners and repository administrators to grant additional people or teams access to repository security alerts, including Dependabot alerts, but the recipients must already have write access to that repository. Users with write, maintain, or admin access can normally view relevant repository security alerts, while additional alert-access assignments are also constrained by repository access. A team that merely has Read access to another repository does not satisfy this requirement. Similarly, an outside collaborator with only Read access or an enterprise member who has not been assigned access to the repository cannot be granted the alert access described by the question. Therefore, members of a team that has Write access to the affected repository meet GitHub's permission requirement.

Comprehensive and Detailed Explanation:

In the advanced setup for CodeQL code scanning, GitHub generates a workflow file named codeql-analysis.yml. This file is located in the .github/workflows directory of your repository. It defines the configuration for the CodeQL analysis, including the languages to analyze, the events that trigger the analysis, and the steps to perform during the workflow.​

Validity checks , also called secret validation , allow GitHub to check if a detected secret is still active . If verified as live, the alert is marked as "valid" , allowing security teams to prioritize the most critical leaks.

Push protection blocks secrets but does not check their validity. Custom patterns are user-defined and do not include live checks.

When a CodeQL workflow uses a language matrix, the matrix explicitly defines which programming languages the workflow analyzes. GitHub states that CodeQL will analyze only the languages included in that matrix; adding or removing matrix entries therefore directly changes the languages scanned. The matrix also allows separate language-analysis jobs to run in parallel, so it does not inherently make analysis sequential. The languages input of the CodeQL init action commonly receives the current matrix.language value, but that describes how the matrix value is passed into CodeQL rather than the principal impact asked for here. The matrix also does not represent dependency exclusions. Consequently, the operational effect being tested is that CodeQL analysis is restricted to the languages explicitly included in the workflow's matrix.

GitHub Advanced Security features can be managed at both the organization and repository levels. Organization owners can control security configurations and Advanced Security access across repositories from the organization's Settings area. At the repository level, administrators can manage eligible security and analysis features through the repository's Settings, subject to any policies or security configurations enforced by the organization or enterprise. Current GitHub terminology separates Advanced Security into products such as GitHub Secret Protection and GitHub Code Security, but the same management hierarchy applies. The organization's Repository permissions area manages general repository access permissions rather than feature licensing or enablement, while enterprise settings primarily establish higher-level policies rather than directly serving as the normal per-repository control described here.

For compiled languages, CodeQL performs extraction by monitoring the normal build process . This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.

This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.

Secrets committed and then deleted are still accessible in the repository’s Git history . To locate them, navigate to the Commits tab. GitHub's secret scanning can detect secrets in both current and historical commits, which is why remediation should also include revoking the secret , not just removing it from the latest code.

The best proactive control is push protection . It scans for secrets during a git push and blocks the commit before it enters the repository.

Other options (like CODEOWNERS or security managers) help with oversight but do not prevent secret leaks.

Making a repo public would increase the risk, not reduce it.

GitHub requires you to perform a dry run before publishing a new secret scanning custom pattern. After defining the pattern and providing a sample test string, you select Save and dry run. GitHub searches the relevant repository data without creating secret scanning alerts and returns a sample of matching results. You should review these results for false positives, adjust the regular expression or additional match requirements if necessary, and repeat the dry run until the pattern behaves as intended. Only after a successful dry run and review should you publish the custom pattern. Push protection is optional and is enabled after the pattern has been published; GitHub explicitly notes that the option is not available until the dry run succeeds and the pattern is published.

For the secret scanning alerts list view specifically, Admin is the correct choice among the supplied roles. GitHub distinguishes between being able to access information about a particular secret associated with your own commits and having access to the repository-wide secret scanning alert list. GitHub's repository-role documentation notes that users with Write or Maintain roles can directly view secret-scanning information associated with their own commits but cannot access the full alert-list view under the standard role model. Repository administrators have the broader security visibility needed for the complete list. Read access is insufficient, while “repository owner” is not a standard repository role for organization-owned repositories. Additional users can also receive alert access when explicitly granted it by an organization owner or repository administrator.

Using the Custom setting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.

This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.

To proactively address secret scanning:

Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

By default , no repositories receive Dependabot alerts unless configuration is explicitly enabled. GitHub does not enable Dependabot alerts automatically for any repositories unless:

The feature is turned on manually

It's configured at the organization or enterprise level via security policies

This includes public, private, and enterprise-owned repositories — manual activation is required .

GitHub secret scanning is designed to identify credentials and other sensitive values that match supported secret patterns. Among the options listed, private keys are the supported secret type. GitHub classifies private keys such as RSA, OpenSSH, EC, and PGP private keys as generic secret patterns. These are distinct from organization-specific custom patterns, which administrators create by defining their own regular expressions. Usernames and general PII are not treated as standard secret-scanning credential patterns, while “sealed boxes” are not a supported secret category. In current GitHub terminology, generic-pattern detection is separately configurable, so it may need to be enabled for the repository. Nevertheless, of the choices presented, private keys are the valid secret-scanning type.