Best GitHub GitHub-Advanced-Security Exam Practice Material Updated on Nov 10, 2025
New GitHub-Advanced-Security Actual Exam Dumps, GitHub Practice Test
GitHub GitHub-Advanced-Security Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION # 37
When using the advanced CodeQL code scanning setup, what is the name of the workflow file?
- A. codeql-analysis.yml
- B. codeql-config.yml
- C. codeql-workflow.yml
- D. codeql-scan.yml
Answer: A
Explanation:
Comprehensive and Detailed Explanation:
In the advanced setup for CodeQL code scanning, GitHub generates a workflow file named codeql-analysis.
yml. This file is located in the .github/workflows directory of your repository. It defines the configuration for the CodeQL analysis, including the languages to analyze, the events that trigger the analysis, and the steps to perform during the workflow.
NEW QUESTION # 38
Which patterns are secret scanning validity checks available to?
- A. Push protection patterns
- B. Partner patterns
- C. Custom patterns
- D. High entropy strings
Answer: B
Explanation:
Validity checks- where GitHub verifies if a secret is still active - are available forpartner patternsonly.
These are secrets issued by GitHub's trusted partners (like AWS, Slack, etc.) and have APIs for GitHub to validate token activity status.
Custom patterns and high entropy patterns donotsupport automated validity checks.
NEW QUESTION # 39
Which of the following is the best way to prevent developers from adding secrets to the repository?
- A. Configure a security manager
- B. Create a CODEOWNERS file
- C. Enable push protection
- D. Make the repository public
Answer: C
Explanation:
The best proactive control ispush protection. It scans for secretsduring a git pushand blocks the commit beforeit enters the repository.
Other options (like CODEOWNERS or security managers) help with oversight but do not prevent secret leaks.
Making a repo public would increase the risk, not reduce it.
NEW QUESTION # 40
As a repository owner, you do not want to run a GitHub Actions workflow when changes are made to any .txt or markdown files. How would you adjust the event trigger for a pull request that targets the main branch?
(Each answer presents part of the solution. Choose three.)
* on:
* pull_request:
* branches: [main]
- A. - '/*.md'
- B. - 'docs/*.md'
- C. - '/*.txt'
- D. paths:
- E. paths-ignore:
Answer: A,C,E
Explanation:
Toexclude.txt and .md files from triggering workflows on pull requests to the main branch:
* on: defines the event (e.g., pull_request)
* pull_request: is the trigger
* paths-ignore: is the key used to ignore file patterns
Example YAML:
yaml
CopyEdit
on:
pull_request:
branches:
- main
paths-ignore:
- '*.md'
- '*.txt'
Using paths: would include only specific files instead - not exclude. paths-ignore: is correct here.
NEW QUESTION # 41
Which security feature shows a vulnerable dependency in a pull request?
- A. The repository's Security tab
- B. Dependency review
- C. Dependency graph
- D. Dependabot alert
Answer: B
Explanation:
Dependency reviewruns as part of a pull request and showswhich dependencies are being added, removed, or changed- andhighlights vulnerabilitiesassociated with any added packages.
It works in real-time and is specifically designed for use during pull request workflows.
Thedependency graphis an overview,Dependabot alertsnotify post-merge, and theSecurity tabshows the aggregated alert list.
NEW QUESTION # 42
In a private repository, what minimum requirements does GitHub need to generate a dependencygraph? (Each answer presents part of the solution. Choose two.)
- A. Read-only access to the dependency manifest and lock files for a repository
- B. Read-only access to all the repository's files
- C. Write access to the dependency manifest and lock files for an enterprise
- D. Dependency graph enabled at the organization level for all new private repositories
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation:
To generate a dependency graph for a private repository, GitHub requires:
Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.
Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
NEW QUESTION # 43
As a repository owner, you want to receive specific notifications, including security alerts, for an individual repository. Which repository notification setting should you use?
- A. Participating and @mentions
- B. All Activity
- C. Ignore
- D. Custom
Answer: D
Explanation:
Using theCustomsetting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.
This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.
NEW QUESTION # 44
Which of the following information can be found in a repository's Security tab?
- A. Access management
- B. Two-factor authentication (2FA) options
- C. GHAS settings
- D. Number of alerts per GHAS feature
Answer: D
Explanation:
TheSecurity tabin a GitHub repository provides a central location for viewing security-related information, especially when GitHub Advanced Security is enabled. The following can be accessed:
* Number ofalertsrelated to:
* Code scanning
* Secret scanning
* Dependency (Dependabot) alerts
* Summary and visibility into open, closed, and dismissed security issues.
It doesnotshow 2FA options, access control settings, or configuration panels for GHAS itself. Those belong to account or organization-level settings.
NEW QUESTION # 45
What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?
- A. Sort to display the oldest first
- B. Sort to display the newest first
- C. Filter to display active secrets
- D. Select only the custom patterns
Answer: C
Explanation:
The best way toprioritizesecret scanning alerts is tofilter by active secrets- these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.
Sorting by time or filtering by custom patterns won't help with risk prioritization directly.
NEW QUESTION # 46
Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:
- A. All new repositories within your organization
- B. User-owned private repositories
- C. Private repositories
- D. Public repositories
Answer: D
Explanation:
By default,secret scanning is enabled automatically for all public repositories. For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.
This default behavior helps protect open-source projects without requiring additional configuration.
NEW QUESTION # 47
As a developer, you need to configure a code scanning workflow for a repository where GitHub Advanced Security is enabled. What minimum repository permission do you need?
- A. None
- B. Write
- C. Read
- D. Admin
Answer: B
Explanation:
To create or modify acode scanning workflow file(typically under .github/workflows/codeql-analysis.yml), you must haveWriteaccess to the repository.
Write permission allows you to commit the workflow file, which is required to run or configure code scanning using GitHub Actions.
NEW QUESTION # 48
Which of the following tasks can be performed by a security team as a proactive measure to help address secret scanning alerts? (Each answer presents a complete solution. Choose two.)
- A. Dismiss alerts that are older than 90 days.
- B. Enable system for cross-domain identity management (SCIM) provisioning for the enterprise.
- C. Configure a webhook to monitor for secret scanning alert events.
- D. Document alternatives to storing secrets in the source code.
Answer: C,D
Explanation:
To proactively address secret scanning:
* Webhookscan be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.
* Documenting secure development practices(like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.
Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.
NEW QUESTION # 49
Which alerts do you see in the repository's Security tab? (Each answer presents part of the solution. Choose three.)
- A. Repository permissions
- B. Code scanning alerts
- C. Security status alerts
- D. Dependabot alerts
- E. Secret scanning alerts
Answer: B,D,E
Explanation:
In a repository'sSecuritytab, you can view:
* Secret scanning alerts: Exposed credentials or tokens
* Dependabot alerts: Vulnerable dependencies from the advisory database
* Code scanning alerts: Vulnerabilities in code detected via static analysis (e.g., CodeQL) Youwon't seegeneral "security status alerts" (not a formal category) or permission-related alerts here.
NEW QUESTION # 50
Which syntax in a query suite tells CodeQL to look for one or more specified .ql files?
- A. qlpack
- B. query
- C. qls
Answer: B
Explanation:
In aquery suite(a .qls file), the **query** key is used to specify the paths to one or more .ql files that should be included in the suite.
Example:
- query: path/to/query.ql
* qls is the file format.
* qlpack is used for packaging queries, not in suite syntax.
NEW QUESTION # 51
A repository's dependency graph includes:
- A. Dependencies from all your repositories.
- B. Annotated code scanning alerts from your repository's dependencies.
- C. A summary of the dependencies used in your organization's repositories.
- D. Dependencies parsed from a repository's manifest and lock files.
Answer: D
Explanation:
Thedependency graphin a repository is built byparsing manifest and lock files(like package.json, pom.xml, requirements.txt). It helps GitHub detect dependencies and cross-reference them with known vulnerability databases for alerting.
It is specific to each repository and does not show org-wide or cross-repo summaries.
NEW QUESTION # 52
A dependency has a known vulnerability. What does the warning message include?
- A. An easily understandable visualization of dependency change
- B. The security impact of these changes
- C. A brief description of the vulnerability
- D. How many projects use these components
Answer: C
Explanation:
When a vulnerability is detected, GitHub shows a warning that includes abrief description of the vulnerability. This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.
This helps developers understand the context and urgency of the vulnerability before applying the fix.
NEW QUESTION # 53
......
Study HIGH Quality GitHub-Advanced-Security Free Study Guides and Exams Tutorials: https://www.dumpsking.com/GitHub-Advanced-Security-testking-dumps.html
Download GitHub GitHub-Advanced-Security Exam Dumps to Pass Exam Easily: https://drive.google.com/open?id=16VL-TSytRdk_i65EEth7ZWWAfa5Mt_yA
