GitHub Advanced Security Quiz 1

GitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts. This is a practice quiz for GHAS certification.

Total questions: 30
Time: 50 minutes
Passing score: 70%

Disclaimer: These are practice questions, not dumps.

START QUIZ

#1. The tool that checks if a pull request introduces any dependencies with security vulnerabilities is called?

Dependabot Security Updates

Dependabot Security Updates

Dependabot Alerts

Dependabot Alerts

Dependabot Version Updates

Dependabot Version Updates

Dependency Review

Dependency Review

#2. You need GitHub Actions enabled for?

Dependabot Security Updates

Dependabot Security Updates

Dependabot Version Updates

Dependabot Version Updates

Dependency Review

Dependency Review

All of these

All of these

#3. What does `CVSS` stand for?

Common Vulnerability Scoring System

Common Vulnerability Scoring System

Code Verification Security System

Code Verification Security System

Critical Vulnerability Scanning Service

Critical Vulnerability Scanning Service

Cybersecurity Validation Scoring Scheme

Cybersecurity Validation Scoring Scheme

#4. What does `CVE` stand for?

Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures

Cybersecurity Verification Entity

Cybersecurity Verification Entity

Common Virus Elimination

Common Virus Elimination

Code Validation and Enumeration

Code Validation and Enumeration

#5. What does `CWE` stand for?

Code Wrapping Engine

Code Wrapping Engine

Cybersecurity Weakness Enumeration

Cybersecurity Weakness Enumeration

Critical Web Elements

Critical Web Elements

Common Weakness Enumeration

Common Weakness Enumeration

#6. Which dependabot comment command will get a pull request successfully completed?

@dependabot close

@dependabot close

@dependabot rebase

@dependabot rebase

@dependabot merge

@dependabot merge

@dependabot cancel merge

@dependabot cancel merge

#7. Jobs that run on macOS runners that GitHub hosts consume minutes at __ rate as Linux runners consume?

the same

the same

10x

10x

5x

5x

2x

2x

#8. Which feature provides a safe space for code maintainers to discuss how to best address errors and vulnerabilities found in the codebase?

Code scanning

Code scanning

Secret scanning

Secret scanning

Dependabots

Dependabots

Security advisories

Security advisories

#9. Which branch(s) is/are scanned to detect the secrets?

active branch (last 30 days)

active branch (last 30 days)

main/master branch

main/master branch

default branch

default branch

all the branches

all the branches

#10. How many days in Git history are scanned by Secret scanning?

all history

all history

120

120

30

30

90

90

#11. Can you add custom patterns to detect specific secrets?

yes

yes

no

no

#12. Which GHAS feature allows you to prevent pushing a commit which contains a secret?

commit scanning

commit scanning

push protection

push protection

check commit

check commit

push scanning

push scanning

#13. Does Dependency graph scan your source code?

yes

yes

no

no

#14. What are the CodeQL languages supported? (Choose three)

Select all that apply:

PHP

PHP

F#

F#

Python

Python

Java

Java

C/C++

C/C++

Ruby on rail

Ruby on rail

SQL

SQL

#15. What are the supported packages managers by Depndabot? (Choose three)

Select all that apply:

Brew

Brew

Yarn

Yarn

PIP

PIP

APT

APT

Yum

Yum

Nuget

Nuget

Men

Men

#16. Which file format permits to integrate results for a 3rd party scanning tool?

GIF

GIF

PDF

PDF

JPEG

JPEG

SARIF

SARIF

#17. What is the name of the file to declare the security policy of a repository?

POLICY.md

POLICY.md

SECURITY.md

SECURITY.md

ADVISORY.md

ADVISORY.md

README.md

README.md

#18. What are Dependabot security updates?

It's a Dependabot feature that creates alerts when a security vulnerability is detected in one of your dependencies.

It's a Dependabot feature that creates alerts when a security vulnerability is detected in one of your dependencies.

It's a Dependabot feature that creates a list of vulnerable dependencies in your repository.

It's a Dependabot feature that creates a list of vulnerable dependencies in your repository.

It's a Dependabot feature that automatically creates pull requests to update dependencies in your repository when they release a new version.

It's a Dependabot feature that automatically creates pull requests to update dependencies in your repository when they release a new version.

It's a Dependabot feature that automatically creates pull requests to update vulnerable dependencies in your repository.

It's a Dependabot feature that automatically creates pull requests to update vulnerable dependencies in your repository.

#19. Dependabot Alerts are enabled by default on?

Only public repositories

Only public repositories

Only private repositories

Only private repositories

All repositories

All repositories

Dependabot Alerts are not enabled by default on any repositories

Dependabot Alerts are not enabled by default on any repositories

#20. Who can enable Dependabot alerts on a repository?

Dependabot alerts are enabled on all repositories by GitHub and can't be disabled or enabled by any individual

Dependabot alerts are enabled on all repositories by GitHub and can't be disabled or enabled by any individual

Only the repository owner

Only the repository owner

Dependabot alerts are enabled by adding a GitHub Action to the repository, so anyone with write access to the repository can enable them

Dependabot alerts are enabled by adding a GitHub Action to the repository, so anyone with write access to the repository can enable them

Repository owners and people with admin access

Repository owners and people with admin access

#21. What's the lowest access level needed to see Dependabot alerts in a repository within an organization?

Triage

Triage

Admin

Admin

Write

Write

Maintain

Maintain

Read

Read

#22. How to enable Dependabot Alerts on all repositories in an organization?

Go to the organization's Code security and analysis settings and enable Dependabot Alerts for all repositories at once.

Go to the organization's Code security and analysis settings and enable Dependabot Alerts for all repositories at once.

On all repositories in the organization - run the actions/enable-ghas GitHub Action with alerts parameter set to true.

On all repositories in the organization - run the actions/enable-ghas GitHub Action with alerts parameter set to true.

Create a script that will enable Dependabot Alerts on all repositories in the organization.

Create a script that will enable Dependabot Alerts on all repositories in the organization.

Make all repositories in the organization private.

Make all repositories in the organization private.

#23. Which of these is not a GitHub supported channel for receiving Dependabot alerts?

GitHub Mobile

GitHub Mobile

GitHub CLI

GitHub CLI

github.com notification inbox

github.com notification inbox

SMS/Call

SMS/Call

#24. What are Dependabot auto-triage rules?

Auto triage rules define how often Dependabot should scan your project for vulnerabilities.

Auto triage rules define how often Dependabot should scan your project for vulnerabilities.

It's a feature that allows Dependabot to automatically dismiss Dependabot alerts that match certain criteria.

It's a feature that allows Dependabot to automatically dismiss Dependabot alerts that match certain criteria.

Dependabot auto-triage rules are used for automatically deleting old dependencies in your project.

Dependabot auto-triage rules are used for automatically deleting old dependencies in your project.

Auto-triage rules are defined in the dependabot.yml configuration file to specify which package managers should be used to scan your project for vulnerabilities.

Auto-triage rules are defined in the dependabot.yml configuration file to specify which package managers should be used to scan your project for vulnerabilities.

#25. How can you automate dismissing low severity Dependabot alerts?

By setting the severity field in dependabot.yml file to high.

By setting the severity field in dependabot.yml file to high.

By setting the dismiss-severity field in dependabot.yml file to low.

By setting the dismiss-severity field in dependabot.yml file to low.

By removing all dependencies that cause low severity alerts.

By removing all dependencies that cause low severity alerts.

By using Dependabot's auto-triage rules.

By using Dependabot's auto-triage rules.

#26. How can you enable GitHub Advanced Security features on GitHub Enterprise Server? (Choose two.)

Select all that apply:

By setting the github.advanced_security.enabled configuration option to true in the config.yml file in the /etc/github directory on the GitHub Enterprise Server instance.

By setting the github.advanced_security.enabled configuration option to true in the config.yml file in the /etc/github directory on the GitHub Enterprise Server instance.

By setting the github.advanced_security.enabled configuration option to true in the config.yml file in the .github repository.

By setting the github.advanced_security.enabled configuration option to true in the config.yml file in the .github repository.

By requesting an upgrade from GitHub Support

By requesting an upgrade from GitHub Support

By connecting directly to the GitHub Enterprise Server instance through SSH and using the administrative shell ghe-config commands.

By connecting directly to the GitHub Enterprise Server instance through SSH and using the administrative shell ghe-config commands.

In the Security tab of the Site admin management console

In the Security tab of the Site admin management console

#27. How can you enable GitHub Advanced Security features for all repositories in an organization in GitHub Enterprise Cloud?

In Code security and analysis section of the organization settings.

In Code security and analysis section of the organization settings.

By requesting an upgrade from GitHub Support.

By requesting an upgrade from GitHub Support.

In the Site admin page of your enterprise account.

In the Site admin page of your enterprise account.

By connecting directly to the GitHub Enterprise Cloud instance through SSH and using the administrative shell ghe-config commands.

By connecting directly to the GitHub Enterprise Cloud instance through SSH and using the administrative shell ghe-config commands.

#28. As a repository maintainer where should you put instructions on how to report a security vulnerability in your codebase?

In the README.md file

In the README.md file

In the CONTRIBUTING.md file

In the CONTRIBUTING.md file

In the SECURITY.md file

In the SECURITY.md file

In the CODE_OF_CONDUCT.md file

In the CODE_OF_CONDUCT.md file

#29. How can you set a default security policy for all repositories in `my-org` GitHub Organization?

Default security policies can only be set by GitHub support

Default security policies can only be set by GitHub support

By editing the security policy in the organization's Code Security and analysis settings

By editing the security policy in the organization's Code Security and analysis settings

By creating a SECURITY.md file in the my-org/.github repository

By creating a SECURITY.md file in the my-org/.github repository

You can set a default security policy for all repositories in my-org GitHub Organization by adding a SECURITY.md file to each individual repository.

You can set a default security policy for all repositories in my-org GitHub Organization by adding a SECURITY.md file to each individual repository.

#30. What is the GitHub security policy?

It's a tool for automatically fixing security vulnerabilities in your code.

It's a tool for automatically fixing security vulnerabilities in your code.

A GitHub security policy is a subscription service that provides antivirus protection for your projects.

A GitHub security policy is a subscription service that provides antivirus protection for your projects.

It's a document that instructs users on how to responsibly report security vulnerabilities in a project. It's typically defined in a SECURITY.md file in a repository.

It's a document that instructs users on how to responsibly report security vulnerabilities in a project. It's typically defined in a SECURITY.md file in a repository.

It's a feature that allows you to encrypt your repository.

It's a feature that allows you to encrypt your repository.

Finish

Results

-

Post Views: 24

Post Views: 24