GitHub Advanced Security — Practice Set 1

Question 1

Your organization is evaluating GitHub Advanced Security (GHAS) for its development teams. Which three distinct security suites make up the GitHub Advanced Security offering?

Accepted Answer

GitHub Advanced Security is organized into three suites: Code Security (which includes CodeQL-based code scanning), Secret Protection (formerly secret scanning), and Supply Chain Security (formerly Dependabot and Dependency Review). GitHub Actions is a CI/CD platform (not a GHAS suite), Branch Protection is a repository setting, and Security Overview is an administrative dashboard within GHAS.

Question 2

Your security team wants a centralized view of security alerts, enablement status, and risk exposure across all repositories in your GitHub organization. Which feature provides this visibility?

Accepted Answer

Security Overview provides organization-wide and enterprise-wide visibility into security alert status, enablement status of GHAS features, and the overall security posture across repositories. Security managers and administrators can use it to identify repositories with unresolved alerts, track remediation progress, and prioritize security work. Repository Insights focuses on contribution metrics, GitHub Actions shows CI/CD workflow status, and Audit Log tracks administrative events.

Question 3

Your team is comparing security approaches for a new application. One approach blocks code from merging until security checks pass, while another approach detects issues after they are merged. Which terms correctly describe these two approaches?

Accepted Answer

A prevention-first approach focuses on detecting and blocking security issues before they enter the codebase (e.g., Push Protection for secrets, pre-merge dependency review). A gate-based security strategy uses checks and policies as gates during the merge process, blocking code that fails security requirements. GHAS supports both approaches, with prevention-first being recommended as the most effective at reducing security debt.

Question 4

You are a security manager. Your organization has thousands of open security alerts across 200 repositories, but the security team is small. You need a way to systematically assign, track, and drive remediation of alerts across multiple teams. Which GHAS feature supports this workflow?

Accepted Answer

Security campaigns in GitHub Advanced Security allow security managers to group related alerts, assign them to developers, track progress, and drive remediation at scale. Campaigns are designed to address the challenge of large volumes of security alerts by providing a structured workflow for bulk remediation across repositories and teams. Branch protection rules control code merge policies, Dependabot handles dependency updates, and CodeQL query packs extend code analysis.

Question 5

A developer accidentally commits an AWS access key to a GitHub repository. Which GitHub Advanced Security feature is designed to detect this exposed secret?

Accepted Answer

Secret Protection (formerly secret scanning) scans repository content for known secret patterns such as API keys, tokens, private keys, and credentials from hundreds of service providers. When a match is found, GitHub creates an alert and can notify the affected service provider (through partner programs) to revoke the exposed secret. Dependabot handles dependency vulnerabilities, CodeQL detects code vulnerabilities, and Dependency Review checks dependencies in pull requests.

Question 6

Your security team wants to prevent developers from committing secrets to repositories in the first place, rather than detecting them after the fact. Which Secret Protection feature should you enable?

Accepted Answer

Push Protection is the prevention-first feature of Secret Protection. When enabled, it scans commits at push time and blocks pushes that contain recognized secrets before they enter the repository. This is fundamentally different from secret scanning alerts (which detect secrets already in the codebase) because it prevents the secret from ever being committed. Developers who trigger Push Protection can review and bypass (with justification) or remove the secret before pushing.

Question 7

You are a security engineer. Your organization develops internal tooling that uses proprietary API tokens not recognized by GitHub's built-in secret scanning patterns. You need these tokens to also be detected by Secret Protection. What should you configure?

Accepted Answer

GitHub Secret Protection allows organizations to define custom secret patterns using regular expressions. This enables detection of proprietary or organization-specific secrets that are not covered by GitHub's default partner patterns. Custom patterns can be configured at the repository or organization level and will trigger alerts just like built-in patterns when matches are found. CODEOWNERS manages code ownership for reviews, Dependabot handles dependency vulnerabilities, and CodeQL performs semantic code analysis.

Question 8

A Secret Protection alert has been raised for a GitHub personal access token found in a repository. What is the recommended first remediation action?

Accepted Answer

When a secret is found in a repository, the immediate priority is to revoke or invalidate the exposed credential to prevent unauthorized use. After revoking, remove the secret from the codebase (including git history if necessary) and replace it with a new credential stored securely (e.g., in GitHub Actions secrets or a secrets manager). Simply deleting the repository or making it private does not invalidate the token or address the security risk. Dismissing an alert for an active token is a security risk.

Question 9

Your organization wants to automatically receive pull requests that update vulnerable dependencies to patched versions. Which GitHub feature provides this capability?

Accepted Answer

Dependabot security updates automatically generates pull requests to update dependencies with known security vulnerabilities to non-vulnerable versions. This is distinct from Dependabot version updates (which keep dependencies current with the latest versions regardless of vulnerabilities). When a Dependabot alert is raised for a vulnerable dependency, Dependabot security updates will attempt to create a PR with a compatible fix.

Question 10

Your security team wants to understand the full list of open-source dependencies used across your repositories, including transitive dependencies. Which feature provides this visibility?

Accepted Answer

The dependency graph in GitHub provides a visual and programmatic view of all direct and transitive (indirect) dependencies for a repository, derived from manifest files (package.json, pom.xml, requirements.txt, etc.). It serves as the foundation for Dependabot alerts, Dependabot security updates, and SBOM exports. Security Overview shows alert status across repositories, code scanning finds code vulnerabilities, and CODEOWNERS defines review ownership.

Question 11

You are a DevSecOps engineer. Your organization wants to prevent pull requests from introducing new vulnerable dependencies before they are merged. Which supply chain security feature should you configure as a required status check?

Accepted Answer

Dependency Review (the dependency-review-action for GitHub Actions) performs a pre-merge check on pull requests, comparing the dependencies being added or updated against known vulnerability databases. When configured as a required status check, it can block merging of pull requests that introduce vulnerable dependencies, license violations, or other policy violations. Dependabot version updates proactively opens PRs but does not gate other PRs, and Push Protection addresses secrets at push time.

Question 12

Your organization needs to provide a software bill of materials (SBOM) to a customer as part of a contractual security requirement. Which two statements about SBOM exports in GitHub are correct? Choose 2.

Accepted Answer

GitHub can export SBOMs derived from the dependency graph, supporting formats such as SPDX (a common SBOM standard). An SBOM is a machine-readable inventory of all software components and their dependencies, which is used for supply chain transparency and compliance. SBOMs are available in multiple formats (not just JSON), they complement rather than replace Dependabot alerts, and they are available for both public and private repositories.

Question 13

Your organization has hundreds of Dependabot alerts across repositories. You want to prioritize remediation based on how likely each vulnerability is to be actively exploited in the wild. Which metric should you use for prioritization?

Accepted Answer

The Exploit Prediction Scoring System (EPSS) provides a probability score (0 to 1) representing the likelihood that a vulnerability will be exploited in the wild within the next 30 days. EPSS is valuable for prioritizing remediation because it reflects real-world exploitation probability, complementing the severity-based CVSS score. A vulnerability may have a moderate CVSS score but a high EPSS score if it is actively being exploited, making it a higher priority for immediate remediation.

Question 14

Your development team uses GitHub Actions for CI/CD. You want to automatically scan your JavaScript application for security vulnerabilities using CodeQL on every pull request. How should you set up this workflow?

Accepted Answer

Code Security with CodeQL is implemented via a GitHub Actions workflow that runs CodeQL analysis on triggers such as push, pull_request, and schedule. GitHub provides a default CodeQL workflow template that you can enable directly from the Security tab. The workflow compiles the code (or uses database extraction for interpreted languages), runs CodeQL queries, and reports results as code scanning alerts. SARIF upload is used for third-party tools, Dependabot handles dependencies, and Push Protection handles secrets.

Question 15

Your organization uses a third-party SAST tool that produces security scan results in a standard format. You want to display these results alongside CodeQL findings in GitHub's code scanning interface. What format should the third-party tool's output be in?

Accepted Answer

GitHub code scanning uses the Static Analysis Results Interchange Format (SARIF) as the standard interchange format for security analysis results. SARIF files from third-party SAST tools can be uploaded to GitHub via the upload-sarif action, and the results are then displayed alongside native CodeQL findings in the Security tab as code scanning alerts. JUnit XML is for test results, JSONL is a general data format, and CycloneDX is an SBOM format.

Question 16

Your security team is reviewing code scanning results for a critical application. You see a code scanning alert that includes dataflow analysis. Which two benefits does dataflow analysis in CodeQL provide compared to simpler pattern-matching scanners? Choose 2.

Accepted Answer

CodeQL's dataflow analysis is a semantic analysis technique that models how data moves through a program. It performs source-to-sink analysis — tracing untrusted input (sources, such as HTTP request parameters) through the code to potentially unsafe operations (sinks, such as SQL queries or shell commands). This semantic understanding allows CodeQL to identify vulnerabilities like SQL injection and XSS with fewer false positives compared to simple pattern matching, because it considers actual execution paths rather than just surface-level patterns.

Question 17

Your CodeQL scan is producing a large number of results and you want to expand coverage to include additional experimental and security-extended queries beyond the default query suite. Which CodeQL query suite should you configure?

Accepted Answer

CodeQL provides several built-in query suites: the 'default' suite contains a carefully curated set of high-precision queries; the 'security-extended' suite includes additional queries beyond the default that provide broader security coverage but may have a higher false-positive rate; the 'security-and-quality' suite adds code quality queries on top of security-extended. To expand coverage with additional security-focused queries, 'security-extended' is the appropriate choice.

Question 18

A code scanning alert references a CWE-89 vulnerability. What type of vulnerability does this represent?

Accepted Answer

CWE-89 is the Common Weakness Enumeration identifier for 'Improper Neutralization of Special Elements used in an SQL Command,' which is the technical definition of SQL injection. The CWE framework categorizes software weaknesses, providing a common language for security tools and teams. GitHub code scanning alerts reference CWE identifiers to help teams understand the class of vulnerability and apply appropriate remediation guidance. CSRF is CWE-352, missing authentication is CWE-306, and broken crypto is CWE-327.

Question 19

Your security team has accumulated hundreds of Dependabot alerts with a low severity rating for a widely-used internal library where the vulnerable function is not called by your code. You want to automatically dismiss these low-impact alerts according to a documented policy. Which feature supports this?

Accepted Answer

Dependabot auto-dismiss rules allow organizations to define criteria for automatically dismissing Dependabot alerts that do not represent real risk. For example, you can auto-dismiss alerts for vulnerabilities with a specific severity level, for development-only dependencies, or for cases where the vulnerable code path is not reachable. This reduces alert noise and allows the security team to focus on impactful vulnerabilities. These dismissals are documented for audit purposes.

Question 20

You are a security engineer managing GHAS for an enterprise with 500 repositories. Your CISO asks you to report on which repositories have critical unresolved code scanning alerts and which GHAS features are disabled. How should you gather this information efficiently?

Accepted Answer

At enterprise scale, the GitHub REST API and GraphQL API provide programmatic access to GHAS alert status, enablement status, and security metrics across repositories. This allows security teams to build reports, dashboards, and automated workflows without manually reviewing each repository. Security Overview provides a built-in visual summary, and the APIs enable custom tooling for bulk operations. Manual review, self-reporting, and local SARIF analysis do not scale to 500 repositories.

Question 21

Your organization wants to implement shift-left security practices in the software development lifecycle. Which two GHAS features support a shift-left approach by identifying security issues as early as possible? Choose 2.

Accepted Answer

Shift-left security moves security checks earlier in the development process. Push Protection acts at the earliest possible point — the developer's push — blocking secrets before they ever enter a repository. Dependency Review acts at the pull request stage, preventing vulnerable dependencies from being merged. Both features implement prevention-first approaches. Dependabot alerts detect issues after merge (reactive, not shift-left), SBOM export is a reporting tool, and restricting visibility to admins does not support early detection.

Question 22

Your organization has recently acquired a new company with 50 GitHub repositories. You need to enable all three GHAS suites across all these repositories efficiently. What is the recommended approach?

Accepted Answer

GitHub Advanced Security features can be enabled at the organization level through organization settings, which applies the configuration to all existing and future repositories. This is the recommended approach for bulk enablement because it is efficient, consistent, and prevents repositories from being missed. The GitHub API and GitHub Enterprise Cloud management features also support bulk enablement at scale. Relying on individual repository owners is inconsistent and error-prone.

Question 23

Your organization uses GitHub Enterprise Cloud. You want security managers to be able to view and dismiss code scanning alerts across all repositories, but you do not want to give them full organization admin rights. Which role should you assign?

Accepted Answer

The Security manager role in GitHub is designed specifically for users who need to manage security alerts and settings across an organization without requiring full organization owner privileges. Security managers can view and dismiss security alerts, access Security Overview, manage security policies, and configure GHAS settings. This follows the principle of least privilege. Organization owner provides full admin rights beyond what is needed, write access on individual repositories is impractical at scale, and billing manager only manages billing.

Question 24

Your security team wants to enforce a standard CodeQL configuration across all repositories in your GitHub Enterprise organization, ensuring every repository uses the approved query suite and scan frequency. Which administrative feature enables this?

Accepted Answer

GitHub's default code scanning setup allows administrators to configure CodeQL at the organization level and apply a standardized configuration (query suite, languages, scan frequency) to all eligible repositories. This ensures consistent security coverage without requiring each development team to maintain their own CodeQL workflow files. Repositories can inherit the organization default or be configured individually for exceptions. Branch protection rules govern merge policies, not scan configuration.

Question 25

A developer on your team discovers a security vulnerability in an open-source library your organization maintains. They want to disclose it responsibly without exposing details publicly before a fix is available. Which GitHub feature facilitates this private, coordinated vulnerability disclosure?

Accepted Answer

GitHub Security Advisories support coordinated vulnerability disclosure (CVD). A private security advisory allows maintainers and researchers to collaborate in a private environment (including a private temporary fork for developing and testing a fix) before the vulnerability is publicly disclosed. Once a fix is ready, the advisory can be published and a CVE can be requested. This process prevents the vulnerability details from being exposed before a patch is available, protecting users of the library.

GH-500 — GitHub Advanced Security