[Mar-2026] GH-500 exam torrent Microsoft study guide
Use Valid New GH-500 Test Notes & GH-500 Valid Exam Guide
Microsoft GH-500 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 18
You are managing code scanning alerts for your repository. You receive an alert highlighting a problem with data flow. What do you click for additional context on the alert?
- A. Show paths
- B. Code scanning alerts
- C. Security
Answer: A
Explanation:
When dealing with a data flow issue in a code scanning alert, clicking on "Show paths" provides a detailed view of the data's journey through the code. This includes the source of the data, the path it takes, and where it ends up (the sink). This information is crucial for understanding how untrusted data might reach sensitive parts of your application and helps in identifying where to implement proper validation or sanitization.
NEW QUESTION # 19
Which of the following statements best describes secret scanning push protection?
- A. Secret scanning alerts must be closed before a branch can be merged into the repository.
- B. Users need to reply to a 2FA challenge before any push events.
- C. Buttons for sensitive actions in the GitHub UI are disabled.
- D. Commits that contain secrets are blocked before code is added to the repository.
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
Secret scanning push protection is a proactive feature that scans for secrets in your code during the push process. If a secret is detected, the push is blocked, preventing the secret from being added to the repository. This helps prevent accidental exposure of sensitive information.
GitHub Docs
NEW QUESTION # 20
After defining a secret scanning custom pattern, what is the final step before publishing the pattern?
- A. performing a dry run
- B. defining a custom pattern
- C. adding additional match requirements
- D. enabling push protection
Answer: A
Explanation:
Defining a custom pattern for a repository [See step 6 below]
Before defining a custom pattern, you must ensure that Secret Protection is enabled on your repository.
1. On GitHub, navigate to the main page of the repository.
2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.
3. In the "Security" section of the sidebar, click Advanced Security.
4. Under "Secret Protection", to the right of "Custom patterns", click New pattern.
5. Enter the details for your new custom pattern. You must at least provide the name for your pattern, and a regular expression for the format of your secret pattern.
*-> 6. When you're ready to test your new custom pattern, to identify matches in the repository without creating alerts, click Save and dry run.
7. When the dry run finishes, you'll see a sample of results (up to 1000). Review the results and identify any false positive results.
8. Edit the new custom pattern to fix any problems with the results, then, to test your changes, click Save and dry run.
9. When you're satisfied with your new custom pattern, click Publish pattern.
10. Optionally, to enable push protection for your custom pattern, click Enable.
NEW QUESTION # 21
The autobuild step in the CodeQL workflow has failed. What should you do?
- A. Remove the autobuild step from your code scanning workflow and add specific build steps.
- B. Use CodeQL, which implicitly detects the supported languages in your code base.
- C. Compile the source code.
- D. Remove specific build steps.
Answer: A
Explanation:
If auto build fails (which attempts to automatically detect how to build your project), you shoulddisable itin your workflow andreplace it with explicit build commands, using steps like run:
make or run: ./gradlew build.
This ensures CodeQL can still extract and analyze the code correctly.
NEW QUESTION # 22
You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? Each answer presents part of the solution. (Choose two.)
- A. in manifest and lock files
- B. in the dependency graph
- C. in security advisories reported on GitHub
- D. in the National Vulnerability Database
Answer: A,C
Explanation:
C: GitHub may send Dependabot alerts to repositories affected by a vulnerability disclosed by a recently published GitHub security advisory.
D: The Dependabot security updates feature is available for repositories where you have enabled the dependency graph and Dependabot alerts. You will see a Dependabot alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file.
NEW QUESTION # 23
What is the minimum role needed in order to view the secret scanning alerts list within the Security tab of a repository?
- A. repository owner
- B. Read
- C. Admin
- D. Write
Answer: A
Explanation:
Viewing and filtering alerts from secret scanning
Who can use this feature?
Repository owners, organization owners, security managers, and users with the admin role Note: About the secret scanning alerts page When you enable secret scanning for a repository or push commits to a repository with secret scanning enabled, GitHub scans the contents for secrets that match patterns defined by service providers.
When secret scanning detects a secret, GitHub generates an alert. GitHub displays an alert in the Security tab of the repository
NEW QUESTION # 24
Which two pieces of information should be included in a security advisory?
- A. Exposures list and administrator name.
- B. Severity and exposure list.
- C. Administrator name and severity.
- D. Product affected and severity.
Answer: D
NEW QUESTION # 25
You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?
- A. When you merge a pull request that contains a security update
- B. When Dependabot creates a pull request to update dependencies
- C. When the pull request checks are successful
- D. When you dismiss the Dependabot alert
Answer: A
Explanation:
A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.
Simply generating a PR or passing checks does not change the alert status; merging is the key step.
NEW QUESTION # 26
In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
- A. Dependency graph enabled at the organization level for all new private repositories
- B. Read-only access to the dependency manifest and lock files for a repository
- C. Read-only access to all the repository's files
- D. Write access to the dependency manifest and lock files for an enterprise
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation:
To generate a dependency graph for a private repository, GitHub requires:
Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.
Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
NEW QUESTION # 27
Where is secret scanning enabled on a private repository?
- A. in the code scanning default set up settings
- B. within a repository ruleset
- C. within a secret.yml file in the repository
- D. in the code security settings
Answer: D
Explanation:
About enabling secure access to private registries
If your organization uses private registries, providing code scanning and Dependabot secure access to these registries will improve code analysis and allow Dependabot to update a wider range of dependencies.
About the importance of providing access to private registries
When a repository uses code stored in a private registry, some security features need access to the registry to enable them to work effectively. Without access to all the dependencies of a repository, code scanning default setup and Dependabot are limited.
Code scanning default setup access to private registries
If you do not define access to the private registries your organization uses, then code scanning will only gather necessary data from dependencies available in public registries.
Defining registry access for code scanning default setup
You need to be an organization owner to set up access to private registries in the user interface.
You can also use the REST API with organization owner or {read,write}_org_private_registries permission.
Note:
1. On the Settings tab for the organization, scroll down to the "Security" section and select Secrets and variables.
2. In the expanded list of secrets and variables, select Private registries to display the "Private Registries" page.
3. Select New private registry to add access details for a private registry.
4. Use the URL and Type fields to define the location and type of the registry:
NEW QUESTION # 28
What does a CodeQL database of your repository contain?
- A. A representation of all of the source code
- B. A build of the code and extracted data
- C. Build commands for C/C++, C#, and Java
- D. A build for Go projects to set up the project
Answer: B
Explanation:
GitHub
Agentic AI for AppSec Teams
Explanation:
Comprehensive and Detailed Explanation:
A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.
GitHub Docs
NEW QUESTION # 29
Which alerts do you see in the repository's Security tab? Each answer presents part of the solution. (Choose three.)
- A. Dependabot alerts
- B. repository permissions
- C. security status alerts
- D. secret scanning alerts
- E. code scanning alerts
Answer: A,D,E
Explanation:
You can find security alerts from Dependabot, Secret scanning, and Code scanning under your repository's Security tab.
NEW QUESTION # 30
Assuming there is no custom Dependabot behavior configured, where possible, what does Dependabot do after sending an alert about a vulnerable dependency in a repository?
- A. Scans any push to all branches and generates an alert for each vulnerable repository
- B. Scans repositories for vulnerable dependencies on a schedule and adds those files to a manifest
- C. Creates a pull request to upgrade the vulnerable dependency to the minimum possible secure version
- D. Constructs a graph of all the repository's dependencies and public dependents for the default branch
Answer: C
Explanation:
After generating an alert for a vulnerable dependency, Dependabot automatically attempts to create a pull request to upgrade that dependency to the minimum required secure version-if a fix is available and compatible with your project.
This automated PR helps teams fix vulnerabilities quickly with minimal manual intervention. You can also configure update behaviors using dependabot.yml, but in the default state, PR creation is automatic.
NEW QUESTION # 31
What is a prerequisite to define a custom pattern for a repository?
- A. Enable secret scanning.
- B. Specify additional match criteria.
- C. Close other secret scanning alerts.
- D. Change the repository visibility to Internal.
Answer: A
Explanation:
Defining a custom pattern for a repository
Before defining a custom pattern, you must ensure that Secret Protection is enabled on your repository.
Note: Enabling secret scanning for your repository
You can configure how GitHub scans your repositories for leaked secrets and generates alerts About enabling secret scanning alerts for users Secret scanning alerts for users can be enabled on any free public repository that you own.
Secret scanning alerts for users can be enabled for any repository that is owned by an organization.
NEW QUESTION # 32
What is the first step you should take to fix an alert in secret scanning?
- A. Remove the secret in a commit to the main branch.
- B. Archive the repository.
- C. Update your dependencies.
- D. Revoke the alert if the secret is still valid.
Answer: D
Explanation:
The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.
Simply deleting the secret from the code does not remove the risk if it hasn't been revoked - especially since it may already be exposed in commit history.
NEW QUESTION # 33
A repository's dependency graph includes:
- A. dependencies parsed from a repository's manifest and lock files.
- B. dependencies from all your repositories.
- C. a summary of the dependencies used in your organization's repositories.
- D. annotated code scanning alerts from your repository's dependencies.
Answer: A
Explanation:
The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems, as well as any dependencies that are submitted using the dependency submission API. This includes:
Direct dependencies, that are explicitly defined in a manifest or lock file or have been submitted using the dependency submission API.
Indirect dependencies of these direct dependencies, also known as transitive dependencies or sub-dependencies.
NEW QUESTION # 34
Where can you find the vulnerable dependencies that GitHub detected in your repository?
- A. in security advisories
- B. in code scanning alerts
- C. in secret scanning alerts
- D. in Dependabot alerts
Answer: D
Explanation:
Identifying vulnerabilities in your project's dependencies with Dependabot alerts Dependabot generates Dependabot alerts when known vulnerabilities are detected in dependencies that your project uses.
Dependabot alerts tab
If GitHub discovers insecure dependencies in your project, you can view details on the Dependabot alerts tab of your repository. Then, you can update your project to resolve or dismiss the alert.
NEW QUESTION # 35
Where can you use CodeQL analysis for code scanning? Each answer presents part of the solution. (Choose two.)
- A. in an external continuous integration (CI) system
- B. in the Files changed tab of the pull request
- C. in a workflow
- D. in a third-party Git repository
Answer: A,C
Explanation:
In a workflow: GitHub Actions workflows are the most common place for CodeQL code scanning.
The codeql-analysis.yml defines how the analysis runs and when it triggers.
In an external CI system: GitHub allows you to run CodeQL analysis outside of GitHub Actions.
Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.
You cannot run or trigger analysis from third-party repositories directly, and the Files changed tabin pull requests only shows diff - not analysis results.
NEW QUESTION # 36
......
GH-500 Exam questions and answers: https://www.itexamsimulator.com/GH-500-brain-dumps.html
GH-500 Actual Questions Answers PDF 100% Cover Real Exam Questions: https://drive.google.com/open?id=1oqIru4y69omFKyt2p6-HshKNMoA4kUhA
