Get Started: GH-500 Exam [2026] Dumps Microsoft PDF Questions
GH-500 Premium Exam Engine pdf Download
Microsoft GH-500 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 60
What does code scanning do?
- A. It contacts maintainers to ask them to create security advisories if a vulnerability is found.
- B. It analyzes a GitHub repository to find security vulnerabilities.
- C. It prevents code pushes with vulnerabilities as a pre-receive hook.
- D. It scans your entire Git history on branches present in your GitHub repository for any secrets.
Answer: B
Explanation:
Code scanning in GitHub Advanced Security for Azure DevOps lets you analyze the code in an Azure DevOps repository to find security vulnerabilities and coding errors.
CodeQL is the code analysis engine developed by GitHub to automate security checks. You can analyze your code using CodeQL and display the results as code scanning alerts.
NEW QUESTION # 61
Which of the following Watch settings could you use to get Dependabot alert notifications? Each answer presents part of the solution. (Choose two.)
- A. the Participating and @mentions setting
- B. the All Activity setting
- C. the Custom setting
- D. the Ignore setting
Answer: B,C
Explanation:
To receive Dependabot alert notifications for a repository, you can utilize the following Watch settings:
Custom setting: Allows you to tailor your notifications, enabling you to subscribe specifically to security alerts, including those from Dependabot.
All Activity setting: Subscribes you to all notifications for the repository, encompassing issues, pull requests, and security alerts like those from Dependabot.
The Participating and @mentions setting limits notifications to conversations you're directly involved in or mentioned, which may not include security alerts. The Ignore setting unsubscribes you from all notifications, including critical security alerts.
NEW QUESTION # 62
By default, which roles can enable Dependabot alerts?
- A. repository maintainers
- B. repository administrators
- C. outside collaborators
- D. security analysts
Answer: B
Explanation:
Repository administrators, organization owners, and users with write or maintain access can enable Dependabot alerts by enabling the dependency graph and Dependabot alerts in their repository's settings. Enabling Dependabot is an action that can be performed at the repository, organization, or enterprise level.
Repository Administrators: These users have access to repository settings, allowing them to enable or disable Dependabot alerts for that specific repository.
NEW QUESTION # 63
In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
- A. dependency graph enabled at the organization level for all new private repositories
- B. read-only access to all the repository's files
- C. write access to the dependency manifest and lock files for an enterprise
- D. read-only access to the dependency manifest and lock files for a repository
Answer: A,D
Explanation:
Configuring the dependency graph
[D] To generate a dependency graph, GitHub needs read-only access to the dependency manifest and lock files for a repository.
[B] Enabling and disabling the dependency graph
Repository administrators can enable or disable the dependency graph for all repositories owned by your user account, regardless of their visibility.
When the dependency graph is first enabled, any manifest and lock files for supported ecosystems are parsed immediately. The graph is usually populated within minutes but this may take longer for repositories with many dependencies. Once enabled, the graph is automatically updated with every push to the repository and every push to other repositories in the graph.
NEW QUESTION # 64
To be compatible with code scanning, what data format must third-party code scanning tools use for output?
- A. Static Analysis Results Interchange Format (SARIF)
- B. comma separated values (CSV)
- C. YAML
- D. ESLint
Answer: A
Explanation:
About code scanning
You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.
About third-party code scanning tools
Code scanning is interoperable with third-party code scanning tools that output Static Analysis Results Interchange Format (SARIF) data. SARIF is an open standard. For more information,
NEW QUESTION # 65
What do you need to do before you can define a custom pattern for a repository?
- A. Enable secret scanning on the repository.
- B. Provide match requirements for the secret format.
- C. Provide a regular expression for the format of your secret pattern.
- D. Add a secret scanning custom pattern.
Answer: A
Explanation:
Stack Overflow
Explanation:
Comprehensive and Detailed Explanation:
Before defining a custom pattern for secret scanning in a repository, you must enable secret scanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.
Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.
NEW QUESTION # 66
What action do you need to include in your workflow to upload a third-party Static Analysis Results Interchange Format (SARIF) file to a repository?
- A. dependency-review
- B. scheduled
- C. upload-sarif
- D. partialFingerprints
Answer: C
Explanation:
Uploading a SARIF file to GitHub
You can upload SARIF files generated outside GitHub and see code scanning alerts from third- party tools in your repository Uploading a code scanning analysis with GitHub Actions To use GitHub Actions to upload a third-party SARIF file to a repository, you'll need a workflow.
Your workflow will need to use the upload-sarif action, which is part of the github/codeql-action repository. It has input parameters that you can use to configure the upload. The main input parameters you'll use are:
sarif_file, which configures the file or directory of SARIF files to be uploaded. The directory or file path is relative to the root of the repository.
category (optional), which assigns a category for results in the SARIF file. This enables you to analyze the same commit in multiple ways and review the results using the code scanning views in GitHub. For example, you can analyze using multiple tools, and in mono-repos, you can analyze different slices of the repository based on the subset of changed files.
NEW QUESTION # 67
What are the permissions and roles required to enable Dependabot alerts on GitHub?
- A. Only repository maintainers can enable Dependabot alerts.
- B. Any user with access to a repository can enable Dependabot alerts.
- C. Only users with write access to a repository can enable Dependabot alerts.
- D. Only users with admin access to a repository can enable Dependabot alerts.
Answer: D
NEW QUESTION # 68
You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)
- A. In the National Vulnerability Database
- B. In security advisories reported on GitHub
- C. In manifest and lock files
- D. In the dependency graph
Answer: A,B
Explanation:
Comprehensive and Detailed Explanation:
Dependabot alerts are generated based on data from various sources:
National Vulnerability Database (NVD): A comprehensive repository of known vulnerabilities, which GitHub integrates into its advisory database.
GitHub Docs
Security Advisories Reported on GitHub: GitHub allows maintainers and security researchers to report and discuss vulnerabilities, which are then included in the advisory database.
The dependency graph and manifest/lock files are tools used by GitHub to determine which dependencies are present in a repository but are not sources of vulnerability disclosures themselves.
NEW QUESTION # 69
The autobuild step in the CodeQL workflow has failed. What should you do?
- A. Compile the source code.
- B. Remove specific build steps.
- C. Remove the autobuild step from your code scanning workflow and add specific build steps.
- D. Use CodeQL, which implicitly detects the supported languages in your code base.
Answer: C
Explanation:
If auto build fails (which attempts to automatically detect how to build your project), you shoulddisable itin your workflow andreplace it with explicit build commands, using steps like run:
make or run: ./gradlew build.
This ensures CodeQL can still extract and analyze the code correctly.
NEW QUESTION # 70
Which of the following options would close a Dependabot alert?
- A. creating a pull request to resolve the vulnerability that will be approved and merged
- B. leaving the repository in its current state
- C. viewing the dependency graph
- D. viewing the Dependabot alert on the Dependabot alerts tab of your repository
Answer: A
Explanation:
To close a Dependabot alert, the primary method is to address the underlying vulnerability. This usually involves merging a pull request that Dependabot creates to update the vulnerable dependency or manually fixing the issue and pushing the updated code. Once the vulnerability is resolved, the alert will be automatically closed. Alternatively, you can manually close alerts in the
"Security" tab of your repository.
Here's a more detailed breakdown:
1. Addressing the Vulnerability:
*-> Merge Dependabot Pull Requests:
If Dependabot has identified a vulnerability and created a pull request to fix it, review and merge the pull request. This will automatically update the dependency and close the alert.
* Manual Fix:
If you prefer to fix the vulnerability yourself, make the necessary code changes to update the dependency. Once the changes are pushed and merged, Dependabot will recognize the fix and close the alert.
2. Manually Closing Alerts (if needed)
NEW QUESTION # 71
What happens when you enable secret scanning on a private repository?
- A. Repository administrators can view Dependabot alerts.
- B. Dependency review, secret scanning, and code scanning are enabled.
- C. GitHub performs a read-only analysis on the repository.
- D. Your team is subscribed to security alerts.
Answer: A
Explanation:
GitHub secret scanning detects and alerts on sensitive data exposure, such as API keys and credentials, in your code repositories. Use it to protect your secrets, ensure secure and compliant development practices, and reduce the risk of data breaches and unauthorized access.
GitHub has scanned public repositories for secrets (like API keys and tokens) for several years.
Secret scanning protects our partners and our customers from unauthorized use of the services protected by those secrets. Just this month, 8% of active GitHub repositories committed a secret that was caught by secret scanning.
At GitHub Satellite, we announced secret scanning for private repositories, part of GitHub Advanced Security. We're bringing the same lightning-fast scanning engine and broad set of 24 partners (including all the major cloud providers and many common SaaS providers) to your private repository, so you can catch secrets as soon as they're checked in. Repository admins will be notified about any commit that contains a secret, and can quickly view all detected secrets in the repo's Security tab.
NEW QUESTION # 72
Secret scanning will ignore a secret_scanning.yml file that
- A. is 1 MB or larger
- B. contains 1,000 or more entries.
- C. has 1,000 or more directories
- D. is 100 KB or larger.
Answer: A
Explanation:
Excluding folders and files from secret scanning
You can customize secret scanning to automatically close alerts for secrets found in specific directories or files by configuring a secret_scanning.yml file in your repository.
* If there are more than 1,000 entries in paths-ignore, secret scanning will only exclude the first
1,000 directories from scans.
* If secret_scanning.yml is larger than 1 MB, secret scanning will ignore the entire file.
NEW QUESTION # 73
Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?
- A. enable all for Dependabot alerts
- B. enable by default for new public repositories
- C. enable all for Dependency graph
- D. enable all in existing repositories
Answer: A
Explanation:
To ensure you're notified whenever a vulnerability is detected via Dependabot, you mustenablealerts for Dependabotin your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.
[Not C] The dependency graph must be enabled for scanning, but does not send alerts itself.
NEW QUESTION # 74
What does a CodeQL database of your repository contain?
- A. A build for Go projects to set up the project
- B. A representation of all of the source code
- C. Build commands for C/C++, C#, and Java
- D. A build of the code and extracted data
Answer: D
Explanation:
GitHub
Agentic AI for AppSec Teams
Explanation:
Comprehensive and Detailed Explanation:
A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.
GitHub Docs
NEW QUESTION # 75
In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?
- A. Enable Dependabot security updates.
- B. Add Dependabot rules.
- C. Add a workflow with the dependency review action.
- D. Enable Dependabot alerts.
Answer: C
Explanation:
To detect and block vulnerable dependencies before merge, developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.
This is a preventative measure during development, unlike Dependabot, which reacts after the fact.
NEW QUESTION # 76
Assuming that no custom patterns are configured, what type of secret is detected by secret scanning?
- A. sealed boxes
- B. private keys
- C. Personal Identifiable Information (PII)
- D. usernames
Answer: B
Explanation:
GitHub secret scanning detects and alerts on sensitive data exposure, such as API keys and credentials, in your code repositories.
NEW QUESTION # 77
......
Pass Your Microsoft Exam with GH-500 Exam Dumps: https://buildazure.actualvce.com/Microsoft/GH-500-valid-vce-dumps.html