Question 1

You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)

Options :

A : In the National Vulnerability Database

B : In the dependency graph

C : In security advisories reported on GitHub

D : In manifest and lock files

Answer: A,C

Question 2

When secret scanning detects a set of credentials on a public repository, what does GitHub do?

Options :

A : It notifies the service provider who issued the secret.

B : It displays a public alert in the Security tab of the repository.

C : It scans the contents of the commits for additional secrets.

D : It sends a notification to repository members.

Answer: A

Question 3

Which of the following is essential for running CodeQL analysis?

Options :

A : The latest version of the code

B : An internet connection

C : A CodeQL database

D : Administrative access to the repository

Answer: C

Question 4

What is a common challenge when interpreting CodeQL results?

Options :

A : Distinguishing between false positives and actual issues

B : All of the above

C : Determining the impact of detected vulnerabilities

D : Understanding the technical jargon

Answer: B

Question 5

When should sensitive data policies be reviewed and updated in GitHub?

Options :

A : Annually

B : When new team members join

C : When new features are added to GitHub

D : When new features are added to GitHub

E : After every major project milestone

F : If there are changes in compliance laws

Answer: D,E,F

Higher Test Marks with Free Online GitHub-Advanced-Security Exam Practice

Buying Options: