Microsoft GH-500 Exam Questions Instant Access

Question 1

-- [Configure GitHub Actions Workflows]

As a repository owner, you do not want to run a GitHub Actions workflow when changes are made to any .txt or markdown files. How would you adjust the event trigger for a pull request that targets the main branch? (Each answer presents part of the solution. Choose three.)

on:

pull_request:

branches: [main]

A- '/*.md'

B- '/*.txt'

Cpaths:

Dpaths-ignore:

E- 'docs/*.md'

Answer : A, B, D

To exclude .txt and .md files from triggering workflows on pull requests to the main branch:

on: defines the event (e.g., pull_request)

pull_request: is the trigger

paths-ignore: is the key used to ignore file patterns

Example YAML:

yaml

CopyEdit

on:

pull_request:

branches:

- main

paths-ignore:

- '*.md'

- '*.txt'

Using paths: would include only specific files instead --- not exclude. paths-ignore: is correct here.

Question 2

-- [Configure and Use Dependency Management]

Which Dependabot configuration fields are required? (Each answer presents part of the solution. Choose three.)

Adirectory

Bpackage-ecosystem

Cmilestone

Dschedule.interval

Eallow

Answer : A, B, D

Comprehensive and Detailed Explanation:

When configuring Dependabot via the dependabot.yml file, the following fields are mandatory for each update configuration:

directory: Specifies the location of the package manifest within the repository. This tells Dependabot where to look for dependency files.

package-ecosystem: Indicates the type of package manager (e.g., npm, pip, maven) used in the specified directory.

schedule.interval: Defines how frequently Dependabot checks for updates (e.g., daily, weekly). This ensures regular scanning for outdated or vulnerable dependencies.

The milestone field is optional and used for associating pull requests with milestones. The allow field is also optional and used to specify which dependencies to update.

GitLab

Question 3

-- [Configure and Use Secret Scanning]

Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:

APublic repositories

BAll new repositories within your organization

CUser-owned private repositories

DPrivate repositories

Answer : A

By default, secret scanning is enabled automatically for all public repositories. For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.

This default behavior helps protect open-source projects without requiring additional configuration.

Question 4

-- [Configure and Use Secret Scanning]

Which patterns are secret scanning validity checks available to?

AHigh entropy strings

BCustom patterns

CPartner patterns

DPush protection patterns

Answer : C

Validity checks --- where GitHub verifies if a secret is still active --- are available for partner patterns only. These are secrets issued by GitHub's trusted partners (like AWS, Slack, etc.) and have APIs for GitHub to validate token activity status.

Custom patterns and high entropy patterns do not support automated validity checks.

Question 5

-- [Use Code Scanning with CodeQL]

When configuring code scanning with CodeQL, what are your options for specifying additional queries? (Each answer presents part of the solution. Choose two.)

APacks

Bgithub/codeql

CScope

DQueries

Answer : A, D

You can customize CodeQL scanning by including additional query packs or by specifying individual queries:

Packs: These are reusable collections of CodeQL queries bundled into a single package.

Queries: You can point to specific files or directories containing .ql queries to include in the analysis.

github/codeql refers to a pack by name but is not a method or field. Scope is not a valid field used for configuration in this context.

Question 6

-- [Describe the GHAS Security Features and Functionality]

What is a security policy?

AAn automatic detection of security vulnerabilities and coding errors in new or modified code

BA security alert issued to a community in response to a vulnerability

CA file in a GitHub repository that provides instructions to users about how to report a security vulnerability

DAn alert about dependencies that are known to contain security vulnerabilities

Answer : C

A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project's transparency and ensures timely communication and mitigation of any reported issues.

Adding this file also enables a ''Report a vulnerability'' button in the repository's Security tab.

Question 7

-- [Configure and Use Dependency Management]

Assuming there is no custom Dependabot behavior configured, where possible, what does Dependabot do after sending an alert about a vulnerable dependency in a repository?

ACreates a pull request to upgrade the vulnerable dependency to the minimum possible secure version

BScans repositories for vulnerable dependencies on a schedule and adds those files to a manifest

CConstructs a graph of all the repository's dependencies and public dependents for the default branch

DScans any push to all branches and generates an alert for each vulnerable repository

Answer : A

After generating an alert for a vulnerable dependency, Dependabot automatically attempts to create a pull request to upgrade that dependency to the minimum required secure version---if a fix is available and compatible with your project.

This automated PR helps teams fix vulnerabilities quickly with minimal manual intervention. You can also configure update behaviors using dependabot.yml, but in the default state, PR creation is automatic.

Microsoft GitHub Advanced Security GH-500 Exam Questions