Real Exam Questions GitHub-Advanced-Security Dumps Exam Questions in here [Feb-2026]
Get Latest Feb-2026 Conduct effective penetration tests using GitHub-Advanced-Security
NEW QUESTION # 46
Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabled? (Each answer presents part of the solution. Choose two.)
- A. It generates a Dependabot alert and displays it on the Security tab for the repository.
- B. It consults with a security service and conducts a thorough vulnerability review.
- C. It generates Dependabot alerts by default for all private repositories.
- D. It notifies the repository administrators about the new alert.
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation:
When GitHub identifies a vulnerable dependency in a repository with Dependabot alerts enabled, it performs the following actions:
Generates a Dependabot alert: The alert is displayed on the repository's Security tab, providing details about the vulnerability and affected dependency.
Notifies repository maintainers: By default, GitHub notifies users with write, maintain, or admin permissions about new Dependabot alerts.
GitHub Docs
These actions ensure that responsible parties are informed promptly to address the vulnerability.
NEW QUESTION # 47
You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)
- A. In the National Vulnerability Database
- B. In the dependency graph
- C. In security advisories reported on GitHub
- D. In manifest and lock files
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation:
Dependabot alerts are generated based on data from various sources:
National Vulnerability Database (NVD): A comprehensive repository of known vulnerabilities, which GitHub integrates into its advisory database.
GitHub Docs
Security Advisories Reported on GitHub: GitHub allows maintainers and security researchers to report and discuss vulnerabilities, which are then included in the advisory database.
The dependency graph and manifest/lock files are tools used by GitHub to determine which dependencies are present in a repository but are not sources of vulnerability disclosures themselves.
NEW QUESTION # 48
Which alerts do you see in the repository's Security tab? (Each answer presents part of the solution. Choose three.)
- A. Repository permissions
- B. Code scanning alerts
- C. Secret scanning alerts
- D. Dependabot alerts
- E. Security status alerts
Answer: B,C,D
Explanation:
In a repository'sSecuritytab, you can view:
* Secret scanning alerts: Exposed credentials or tokens
* Dependabot alerts: Vulnerable dependencies from the advisory database
* Code scanning alerts: Vulnerabilities in code detected via static analysis (e.g., CodeQL) Youwon't seegeneral "security status alerts" (not a formal category) or permission-related alerts here.
NEW QUESTION # 49
Secret scanning will scan:
- A. A continuous integration system.
- B. Any Git repository.
- C. External services.
- D. The GitHub repository.
Answer: D
Explanation:
Secret scanning is a feature provided by GitHub that scans the contents of your GitHub repositories for known types of secrets, such as API keys and tokens. It operates within the GitHub environment and does not scan external systems, services, or repositories outside of GitHub. Its primary function is to prevent the accidental exposure of sensitive information within your GitHub-hosted code.
NEW QUESTION # 50
Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?
- A. Secret validation
- B. Non-provider patterns
- C. Custom pattern dry runs
- D. Push protection
Answer: A
Explanation:
Secret validationchecks whether a secret found in your repository is still valid and active with the issuing provider (e.g., AWS, GitHub, Stripe). If a secret is confirmed to be active, the alert ismarked as verified, which means it's considered ahigh-priority issuebecause it presents an immediate security risk.
This helps teams respond faster tovalid, exploitablesecrets rather than wasting time on expired or fake tokens.
NEW QUESTION # 51
Which patterns are secret scanning validity checks available to?
- A. High entropy strings
- B. Partner patterns
- C. Custom patterns
- D. Push protection patterns
Answer: B
Explanation:
Validity checks- where GitHub verifies if a secret is still active - are available forpartner patternsonly.
These are secrets issued by GitHub's trusted partners (like AWS, Slack, etc.) and have APIs for GitHub to validate token activity status.
Custom patterns and high entropy patterns donotsupport automated validity checks.
NEW QUESTION # 52
Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?
- A. CodeQL analyzes the code and raises vulnerabilities in third-party dependencies
- B. A dependency graph is created, and Dependabot compares the graph to the GitHub Advisorydatabase
- C. The build tool finds the vulnerable dependencies and calls the Dependabot API
- D. Dependabot reviews manifest files in the repository
Answer: B
Explanation:
Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.
This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.
NEW QUESTION # 53
Which of the following options would close a Dependabot alert?
- A. Creating a pull request to resolve the vulnerability that will be approved and merged
- B. Viewing the dependency graph
- C. Viewing the Dependabot alert on the Dependabot alerts tab of your repository
- D. Leaving the repository in its current state
Answer: A
Explanation:
ADependabot alertis only marked asresolvedwhen the related vulnerability is no longer present in your code
- specifically after youmerge a pull requestthat updates the vulnerable dependency.
Simply viewing alerts or graphs doesnotaffect their status. Ignoring the alert by leaving the repo unchanged keeps the vulnerability active and unresolved.
NEW QUESTION # 54
Where can you use CodeQL analysis for code scanning? (Each answer presents part of the solution. Choose two.)
- A. In the Files changed tab of the pull request
- B. In a workflow
- C. In an external continuous integration (CI) system
- D. In a third-party Git repository
Answer: B,C
Explanation:
* In a workflow: GitHub Actions workflows are the most common place for CodeQL code scanning.
The codeql-analysis.yml defines how the analysis runs and when it triggers.
* In an external CI system: GitHub allows you to run CodeQL analysis outside of GitHub Actions.
Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.
You cannot run or trigger analysis from third-party repositories directly, and theFiles changed tabin pull requests only shows diff - not analysis results.
NEW QUESTION # 55
Which of the following information can be found in a repository's Security tab?
- A. Access management
- B. Two-factor authentication (2FA) options
- C. Number of alerts per GHAS feature
- D. GHAS settings
Answer: C
Explanation:
TheSecurity tabin a GitHub repository provides a central location for viewing security-related information, especially when GitHub Advanced Security is enabled. The following can be accessed:
* Number ofalertsrelated to:
* Code scanning
* Secret scanning
* Dependency (Dependabot) alerts
* Summary and visibility into open, closed, and dismissed security issues.
It doesnotshow 2FA options, access control settings, or configuration panels for GHAS itself. Those belong to account or organization-level settings.
NEW QUESTION # 56
You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?
- A. When Dependabot creates a pull request to update dependencies
- B. When the pull request checks are successful
- C. When you merge a pull request that contains a security update
- D. When you dismiss the Dependabot alert
Answer: C
Explanation:
A Dependabot alert is marked asresolvedonly after the relatedpull request is mergedinto the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.
Simply generating a PR or passing checks does not change the alert status; merging is the key step.
NEW QUESTION # 57
What should you do after receiving an alert about a dependency added in a pull request?
- A. Update the vulnerable dependencies before the branch is merged
- B. Deploy the code to your default branch
- C. Fork the branch and deploy the new fork
- D. Disable Dependabot alerts for all repositories owned by your organization
Answer: A
Explanation:
If an alert is raised on apull request dependency, best practice is toupdate the dependencyto a secure versionbeforemerging the PR. This prevents the vulnerable version from entering the main codebase.
Merging or deploying the PR without fixing the issue exposes your production environment to known risks.
NEW QUESTION # 58
When using CodeQL, how does extraction for compiled languages work?
- A. By resolving dependencies to give an accurate representation of the codebase
- B. By generating one language at a time
- C. By monitoring the normal build process
- D. By running directly on the source code
Answer: C
Explanation:
For compiled languages, CodeQL performs extraction bymonitoring the normal build process. This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.
This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.
NEW QUESTION # 59
As a developer, you need to configure a code scanning workflow for a repository where GitHub Advanced Security is enabled. What minimum repository permission do you need?
- A. None
- B. Write
- C. Admin
- D. Read
Answer: B
Explanation:
To create or modify acode scanning workflow file(typically under .github/workflows/codeql-analysis.yml), you must haveWriteaccess to the repository.
Write permission allows you to commit the workflow file, which is required to run or configure code scanning using GitHub Actions.
NEW QUESTION # 60
What do you need to do before you can define a custom pattern for a repository?
- A. Add a secret scanning custom pattern.
- B. Provide match requirements for the secret format.Stack Overflow
- C. Provide a regular expression for the format of your secret pattern.
- D. Enable secret scanning on the repository.
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
Before defining a custom pattern for secret scanning in a repository, you must enable secretscanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.
Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.
NEW QUESTION # 61
When secret scanning detects a set of credentials on a public repository, what does GitHub do?
- A. It notifies the service provider who issued the secret.
- B. It sends a notification to repository members.
- C. It displays a public alert in the Security tab of the repository.
- D. It scans the contents of the commits for additional secrets.
Answer: A
Explanation:
When apublic repositorycontains credentials that match known secret formats, GitHub willautomatically notify the service providerthat issued the secret. This process is known as"secret scanning partner notification". The provider may then revoke the secret or contact the userdirectly.
GitHub doesnotpublicly display the alert and does not send internal repository notifications for public detections.
NEW QUESTION # 62
Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?
- A. An enterprise administrator
- B. A repository member of an enterprise organization
- C. A user who has read access to the repository
- D. A user who has write access to the repository
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
By default, users with write access to a repository have the ability to merge pull requests, including those created by Dependabot for security updates. This access level allows contributors to manage and integrate changes, ensuring that vulnerabilities are addressed promptly.
Users with only read access cannot merge pull requests, and enterprise administrators do not automatically have merge rights unless they have write or higher permissions on the specific repository.
NEW QUESTION # 63
What is a security policy?
- A. A file in a GitHub repository that provides instructions to users about how to report a security vulnerability
- B. An automatic detection of security vulnerabilities and coding errors in new or modified code
- C. An alert about dependencies that are known to contain security vulnerabilities
- D. A security alert issued to a community in response to a vulnerability
Answer: A
Explanation:
A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project's transparency and ensures timely communication and mitigation of any reported issues.
Adding this file also enables a "Report a vulnerability" button in the repository's Security tab.
NEW QUESTION # 64
......
Authentic Best resources for GitHub-Advanced-Security Online Practice Exam: https://www.testpassed.com/GitHub-Advanced-Security-still-valid-exam.html
Get the superior quality GitHub-Advanced-Security Dumps with explanations waiting just for you, get it now: https://drive.google.com/open?id=1S8zHQUQAYgDJUUYaiyMpwWE7BKwVTJ39