GH-500 by Microsoft Valid Free Exam Practice Test

Question 1

Which of the following benefits do code scanning, secret scanning, and dependency review provide?

A. Automatically raise pull requests, which reduces your exposure to older versions of dependencies. B. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies. C. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository's code. D. View alerts about dependencies that are known to contain security vulnerabilities.

Correct Answer: B

Question 2

A dependency has a known vulnerability. What does the warning message include?

A. the security impact of these changes B. how many projects use these components C. a brief description of the vulnerability D. an easily understandable visualization of dependency change

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 3

Where can you use CodeQL analysis for code scanning? Each answer presents part of the solution. (Choose two.)

A. in a third-party Git repository B. in a workflow C. in the Files changed tab of the pull request D. in an external continuous integration (CI) system

Correct Answer: B,D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 4

What scenario demonstrates the use of Dependabot security updates?

A. An alert is created for a vulnerable dependency. B. An alert is created for a secret that's been exposed in the codebase. C. A pull request is opened that fixes a vulnerable dependency. D. A pull request is opened that updates a dependency to the most recent version.

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 5

What are the default settings for Dependabot alerts in public and private repositories on GitHub?

A. Dependabot alerts are enabled by default for public repositories and disabled by default for private repositories. B. Dependabot alerts are disabled by default for both public and private repositories. C. Dependabot alerts are disabled by default for public repositories and enabled by default for private repositories. D. Dependabot alerts are enabled by default for both public and private repositories.

Correct Answer: A

Question 6

Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)

A. pull_request B. trigger C. workflow_dispatch D. commit

Correct Answer: A,D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 7

You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? Each answer presents part of the solution. (Choose two.)

A. in manifest and lock files B. in the dependency graph C. in security advisories reported on GitHub D. in the National Vulnerability Database

Correct Answer: A,C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Microsoft GitHub Advanced Security - GH-500 Exam Practice Test