Microsoft GitHub Advanced Security (GH-500) Certification Sample Questions

GitHub Advanced Security Dumps, GH-500 Dumps, GH-500 PDF, GitHub Advanced Security VCE, Microsoft GH-500 VCE, Microsoft GitHub Advanced Security PDF The purpose of this Sample Question Set is to provide you with information about the Microsoft GitHub Advanced Security exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GH-500 certification test. To get familiar with real exam environment, we suggest you try our Sample Microsoft GitHub Advanced Security Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual Microsoft GitHub Advanced Security certification exam.

These sample questions are simple and basic questions that represent likeness to the real Microsoft GH-500 exam questions. To assess your readiness and performance with real time scenario based questions, we suggest you prepare with our Premium Microsoft GitHub Advanced Security Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.

Microsoft GH-500 Sample Questions:

01. How does secret scanning availability differ for public and private repositories on GitHub?

a) It is available only on public repositories, and a private repository cannot turn it on at all.

b) It is available only on private repositories, since code in a public repository can already be read by anyone.

c) It runs at no cost on public repositories, while a private repository needs a paid license to enable it.

d) It is unavailable on both, and finding committed credentials requires a third-party scanner.

02. Reference Scenario: GH-500 Case 5 — Pinecrest Ticketing password detection, dismissal control and acquisition onboarding

The platform team adds a step to the migration pipeline to meet requirement 4. In each option, {id} is the ID of pinecrest-standard. Which request should the step send?

a) POST /orgs/pinecrest/code-security/configurations/{id}/attach with scope set to selected and the 45 repository IDs

b) POST /orgs/pinecrest/code-security/configurations/{id}/attach with scope set to all

c) POST /orgs/pinecrest/code-security/configurations/{id}/attach with scope set to all_without_configurations

d) PUT /orgs/pinecrest/code-security/configurations/{id}/defaults with default_for_new_repos set to all

03. Reference Scenario: GH-500 Case 2 — Brightwater Mutual claims-portal and policy-engine security rollout

For requirement 5, procurement asks what Brightwater would lose if it renewed GitHub Secret Protection but did not renew GitHub Code Security. Which two capabilities would no longer be available on the private repositories?

Each correct answer presents a complete solution.

a) Push protection for supported partner secret types

b) Dependency review on pull requests

c) Dependabot alerts for vulnerable dependencies

d) Code scanning alerts, including SARIF results uploaded from external tools

04. What is the difference between scheduled versus triggered events in code scanning?

a) Scheduled events run based on a specified schedule and triggered events run on code events such as a push.

b) Triggered events run on the cron schedule set in the workflow, and scheduled events run whenever code is pushed.

c) Scheduled events can only be configured by an organization owner, and triggered events by anyone with write access.

d) Scheduled events run the full CodeQL query suite, and triggered events run a reduced set of quick queries.

05. Reference Scenario: GH-500 Case 3 — Tallgrass Freight security configuration and on-premises Dependabot rollout

Ines will meet requirement 2 with the existing tallgrass-standard configuration. What should she change?

a) Set tallgrass-standard as the default for new private and internal repositories, and set its policy to Enforce

b) Set tallgrass-standard as the default for all new repositories, and give the security team the security manager role to restore disabled features

c) Set tallgrass-standard as the default for all new repositories, and set its policy to Enforce

d) Set tallgrass-standard as the default for all new repositories, and add an organization ruleset that requires code scanning results

06. How does GitHub Advanced Security (GHAS) help integrate security into each step of the software development life cycle?

a) By providing a comprehensive dashboard summarizing the security status of the repository.

b) By generating alerts for dependencies with known vulnerabilities recorded in the GitHub Advisory Database.

c) By providing access to curated security intelligence from millions of developers and security researchers around the world.

d) By automating security checks with every pull request, surfacing issues in the context of the development workflow.

07. Reference Scenario: GH-500 Case 4 — Lumenfield Learning push protection approvals and alert triage at scale

Tomas is creating an organization webhook that delivers to the ticketing system, to meet requirement 5. Which two events should the webhook subscribe to?

(Choose two.)

a) repository_advisory

b) security_advisory

c) dependabot_alert

d) secret_scanning_alert

08. Reference Scenario: GH-500 Case 1 — Kestrel Ridge Geodata tilekit and atlas-web hardening

The tilekit maintainers want a repeatable disclosure process, starting with the researcher's path traversal report. Which approach meets requirement 2?

a) Enable private vulnerability reporting, work the report in a draft security advisory and its temporary private fork, request a CVE ID and publish

b) Have the researcher file an issue that only maintainers can see, fix it on a protected branch and list the CVE in the release notes

c) Ask the researcher to open a pull request in github/advisory-database describing the flaw, then fix it on a branch of tilekit

d) Create a security campaign for tilekit, add the reported flaw to it as a tracked item, assign it to the maintainers and let Copilot Autofix propose the fix

09. What are the default settings for Dependabot alerts in public and private repositories on GitHub?

a) Dependabot alerts are disabled by default for both public and private repositories.

b) Dependabot alerts are enabled by default for public repositories and disabled by default for private repositories.

c) Dependabot alerts are disabled by default for public repositories and enabled by default for private repositories.

d) Dependabot alerts are enabled by default for both public and private repositories.

10. Reference Scenario: GH-500 Case 5 — Pinecrest Ticketing password detection, dismissal control and acquisition onboarding

Marco opens the SQL injection alert in box-office-api and wants to work as requirement 2 describes. What should he do on the alert page?

a) Click Show more to read the rule's description of SQL injection and its guidance on fixing it

b) Open the log of the CodeQL analysis run that raised the alert and search it for the query name

c) Generate a Copilot Autofix suggestion and compare the proposed change with the flagged line

d) Click Show paths to view the numbered steps from where the data enters the code to the sink

Answers:

Question: 01 Answer: c	Question: 02 Answer: a	Question: 03 Answer: b, d	Question: 04 Answer: a	Question: 05 Answer: c
Question: 06 Answer: d	Question: 07 Answer: c, d	Question: 08 Answer: a	Question: 09 Answer: b	Question: 10 Answer: d

Note: For any error in Microsoft GitHub Advanced Security (GH-500) certification exam sample questions, please update us by writing an email on feedback@edusum.com.