Microsoft GH-500 Exam Questions Instant Access

Question 1

-- [Configure and Use Dependency Management]

You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)

AIn the National Vulnerability Database

BIn the dependency graph

CIn security advisories reported on GitHub

DIn manifest and lock files

Answer : A, C

Comprehensive and Detailed Explanation:

Dependabot alerts are generated based on data from various sources:

National Vulnerability Database (NVD): A comprehensive repository of known vulnerabilities, which GitHub integrates into its advisory database.

GitHub Docs

Security Advisories Reported on GitHub: GitHub allows maintainers and security researchers to report and discuss vulnerabilities, which are then included in the advisory database.

The dependency graph and manifest/lock files are tools used by GitHub to determine which dependencies are present in a repository but are not sources of vulnerability disclosures themselves.

Question 2

-- [Describe GitHub Advanced Security Best Practices]

What kind of repository permissions do you need to request a Common Vulnerabilities and Exposures (CVE) identification number for a security advisory?

AMaintain

BAdmin

CTriage

DWrite

Answer : B

Requesting a CVE ID for a security advisory in a GitHub repository requires Admin permissions. This level of access is necessary because it involves managing sensitive security information and coordinating with external entities to assign a CVE, which is a formal process that can impact the public perception and security posture of the project.

Question 3

-- [Configure and Use Dependency Management]

When does Dependabot alert you of a vulnerability in your software development process?

AWhen a pull request adding a vulnerable dependency is opened

BAs soon as a vulnerable dependency is detected

CAs soon as a pull request is opened by a contributor

DWhen Dependabot opens a pull request to update a vulnerable dependency

Answer : B

Dependabot alerts are generated as soon as GitHub detects a known vulnerability in one of your dependencies. GitHub does this by analyzing your repository's dependency graph and matching it against vulnerabilities listed in the GitHub Advisory Database. Once a match is found, the system raises an alert automatically without waiting for a PR or manual action.

This allows organizations to proactively mitigate vulnerabilities as early as possible, based on real-time detection.

Question 4

-- [Configure and Use Secret Scanning]

What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?

ASort to display the oldest first

BSort to display the newest first

CFilter to display active secrets

DSelect only the custom patterns

Answer : C

The best way to prioritize secret scanning alerts is to filter by active secrets --- these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.

Sorting by time or filtering by custom patterns won't help with risk prioritization directly.

Question 5

-- [Describe GitHub Advanced Security Best Practices]

Which of the following tasks can be performed by a security team as a proactive measure to help address secret scanning alerts? (Each answer presents a complete solution. Choose two.)

ADismiss alerts that are older than 90 days.

BConfigure a webhook to monitor for secret scanning alert events.

CEnable system for cross-domain identity management (SCIM) provisioning for the enterprise.

DDocument alternatives to storing secrets in the source code.

Answer : B, D

To proactively address secret scanning:

Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

Question 6

-- [Configure and Use Dependency Management]

Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?

ADependabot reviews manifest files in the repository

BCodeQL analyzes the code and raises vulnerabilities in third-party dependencies

CA dependency graph is created, and Dependabot compares the graph to the GitHub Advisory database

DThe build tool finds the vulnerable dependencies and calls the Dependabot API

Answer : C

Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.

This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.

Question 7

-- [Configure and Use Dependency Management]

Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?

AAn enterprise administrator

BA user who has write access to the repository

CA user who has read access to the repository

DA repository member of an enterprise organization

Answer : B

Comprehensive and Detailed Explanation:

By default, users with write access to a repository have the ability to merge pull requests, including those created by Dependabot for security updates. This access level allows contributors to manage and integrate changes, ensuring that vulnerabilities are addressed promptly.

Users with only read access cannot merge pull requests, and enterprise administrators do not automatically have merge rights unless they have write or higher permissions on the specific repository.

Microsoft GitHub Advanced Security GH-500 Exam Questions