Microsoft Certification
60 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft GitHub Advanced Security (GH-500) certification validates professional expertise in Microsoft technologies. This study guide covers all 60 practice questions from our GH-500 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
What is the primary purpose of GitHub's secret scanning feature?
Secret scanning detects credentials and sensitive patterns in code to prevent accidental exposure of API keys, tokens, and passwords.
Which of the following best describes the relationship between SARIF and GitHub Advanced Security?
SARIF (Static Analysis Results Interchange Format) is an open standard that GitHub Advanced Security uses to ingest and display results from various security scanning tools.
When configuring dependency updates with Dependabot, what is the impact of setting the 'insecure-external-code-execution' option to 'deny'?
Setting 'insecure-external-code-execution' to 'deny' prevents Dependabot from updating dependencies that would require running untrusted code during installation or compilation.
What is the primary difference between CodeQL analysis performed on a schedule versus on pull requests?
Scheduled CodeQL scans analyze the entire repository to build a complete picture of vulnerabilities, while PR-based analysis focuses on new or modified code for faster feedback during development.
In GitHub Advanced Security, what does the 'severity' label indicate for a code scanning alert?
Severity levels (low, medium, high, critical) in code scanning alerts indicate the potential impact and risk associated with the identified vulnerability.
How does GitHub's secret scanning handle false positives when a non-secret pattern matches a scanning rule?
Repository administrators can review secret scanning alerts and dismiss those identified as false positives directly in the repository's security overview.
What is the primary advantage of using custom CodeQL queries versus relying only on default queries?
Custom CodeQL queries enable detection of organization-specific security patterns, compliance issues, and architectural vulnerabilities beyond what default queries provide.
When a secret is detected by GitHub's secret scanning, which of the following actions occurs automatically?
Secret scanning creates an alert in the repository security tab and can notify the secret provider (like GitHub's token scanning) when a match is found, allowing for credential rotation.
What is the role of the 'codeql-action' in GitHub Advanced Security workflows?
The codeql-action is the primary GitHub Action used to orchestrate CodeQL database creation, analysis execution, and result uploads within CI/CD workflows.
How does GitHub Advanced Security handle dependency vulnerabilities discovered after a release has been deployed to production?
Dependabot continuously monitors dependencies and creates alerts for newly discovered vulnerabilities, allowing teams to respond quickly even for already-deployed versions.
What is the significance of the 'default' branch configuration in CodeQL analysis settings?
Configuring the default branch in CodeQL settings establishes the baseline for comparing pull request analysis, helping identify new vulnerabilities introduced by changes.
In the context of GitHub Advanced Security, what does 'data flow analysis' in CodeQL primarily detect?
CodeQL's data flow analysis traces how user input and untrusted data propagate through functions and methods to identify injection vulnerabilities and unsafe operations.
What is the primary benefit of enabling 'Dependabot alerts' for a private repository?
Dependabot alerts provide proactive vulnerability notification with detailed information about affected versions and recommended upgrade paths, enabling timely security responses.
How can an organization ensure that all code scanning results are reviewed before code is merged to protected branches?
Branch protection rules can be configured to require code scanning checks to pass and dismiss alerts to be resolved before pull requests can be merged.
What does the 'dismiss' action on a code scanning alert indicate?
Dismissing alerts allows teams to acknowledge and categorize resolved or non-actionable findings while maintaining an audit trail of the dismissal decision.
In CodeQL, what is the purpose of database creation before query execution?
CodeQL database creation converts source code into a structured, queryable database that enables complex semantic analysis and vulnerability detection.
What is the primary difference between supply chain attacks detected by GitHub Advanced Security and typical dependency vulnerabilities?
Supply chain attacks involve intentionally malicious packages or compromised legitimate packages, while dependency vulnerabilities are unintentional flaws in package code.
How does GitHub Advanced Security's secret scanning integrate with partner platforms like AWS or Slack?
GitHub's secret scanning supports partner integrations that allow automatic notification to providers (AWS, Slack, etc.) when their credentials are detected, enabling rapid credential rotation.
What is the significance of 'confidence' levels in CodeQL alert results?
Confidence levels (low, medium, high) in CodeQL results indicate the probability that the flagged code pattern represents a genuine security vulnerability versus a false positive.
When configuring Dependabot version updates, what is the function of the 'allow' field in the dependabot.yml file?
The 'allow' field in dependabot.yml configuration permits fine-grained control over which categories of dependencies receive update pull requests.
What is the primary purpose of security advisories in GitHub Advanced Security?
Security advisories allow maintainers to publicly disclose vulnerabilities in their projects, providing information to downstream consumers about affected versions and remediation steps.
How does CodeQL's 'taint tracking' specifically contribute to vulnerability detection?
Taint tracking in CodeQL identifies when untrusted input reaches sensitive operations without proper validation or sanitization, detecting injection vulnerabilities.
In GitHub Advanced Security, what action should be taken when a secret scanning alert is flagged for a credential that has already been committed?
When a credential is exposed in commit history, it must be revoked immediately and removed from all commits using history rewriting tools, as git history is recoverable.
What is the relationship between GitHub Advanced Security and GitHub's default security features?
GitHub Advanced Security augments free features with CodeQL code scanning, push protection, and enhanced dependency analysis, available through licensing.
How can an organization customize which secret patterns GitHub Advanced Security scans for?
GitHub Advanced Security allows organizations to define custom secret scanning patterns via regex to detect proprietary credentials, API keys, or internal formats.
What is the primary purpose of GitHub Advanced Security?
GitHub Advanced Security is designed to help identify and fix vulnerabilities in code through code scanning, secret scanning, and dependency analysis features.
Which of the following best describes the role of CodeQL in GitHub Advanced Security?
CodeQL is a semantic code analysis engine that uses a query language to identify potential security vulnerabilities and coding errors across codebases.
When enabling Secret Scanning for a GitHub repository, which of the following is NOT a default pattern that gets scanned?
Secret Scanning has predefined patterns for known secret types like API keys, tokens, and SSH keys, but does not scan for generic JavaScript variable names as these are not credentials.
What is the relationship between Dependabot and GitHub Advanced Security?
Dependabot is integrated with GitHub Advanced Security and automatically scans for vulnerable dependencies, creating pull requests to update them when vulnerabilities are found.
In the context of Code Scanning with CodeQL, what does a 'query' represent?
CodeQL queries are essentially rules that analyze code to identify vulnerabilities, bugs, and other issues. Multiple queries can be combined in query suites to perform comprehensive analysis.
Which file should be created in the `.github/workflows` directory to configure Code Scanning with CodeQL?
Code Scanning is typically configured using a GitHub Actions workflow file (scan.yaml or scan.yml) placed in the `.github/workflows` directory to automate CodeQL analysis.
What is the primary difference between 'push' and 'pull_request' events in a Code Scanning workflow?
Using 'push' scans code when commits are pushed directly, while 'pull_request' scans code in PR branches before merging, allowing issues to be caught earlier in the review process.
When configuring Secret Scanning, what does enabling 'Push Protection' accomplish?
Push Protection uses Secret Scanning patterns to detect and block commits containing secrets before they reach the repository, preventing accidental exposure of sensitive credentials.
Which of the following scenarios would require using a custom CodeQL query instead of default queries?
Custom CodeQL queries are created to detect organization-specific vulnerabilities, coding patterns, or policy violations that default queries don't address.
What is the purpose of the 'sarif' format in GitHub Advanced Security?
SARIF (Static Analysis Results Interchange Format) is a standardized JSON format that allows results from external code analysis tools to be uploaded to GitHub and displayed alongside native scanning results.
When a Code Scanning alert is generated, what information should be reviewed to determine its severity?
Code Scanning alerts include the rule that triggered them, a security severity level, and CWE (Common Weakness Enumeration) information to help assess the actual risk and prioritize remediation.
Which GitHub Advanced Security feature is specifically designed to prevent accidental exposure of credentials in version control history?
Secret Scanning with Push Protection specifically detects and blocks commits containing secrets like API keys and tokens, preventing their accidental exposure in repository history.
What is a 'false positive' in the context of Code Scanning, and how should it be handled?
False positives are alerts for code that CodeQL flags but which isn't actually vulnerable. These should be marked appropriately in GitHub to reduce noise and help train the analysis engine.
In GitHub Advanced Security, what does the 'Dependency graph' feature primarily help identify?
The Dependency graph maps all dependencies in a repository, helping identify which packages are used and enabling vulnerability detection when those dependencies have known issues.
When configuring CodeQL analysis for a multi-language repository, what should be considered?
Multi-language repositories require careful configuration in the CodeQL workflow to specify which languages to analyze and ensure appropriate query suites are applied to each language.
What is the primary benefit of using GitHub Advanced Security with GitHub Actions for continuous security scanning?
Integrating GitHub Advanced Security with Actions enables automated, continuous security analysis that runs consistently on every code change, catching vulnerabilities early in the development process.
Which of the following best describes the role of 'severity levels' in Code Scanning alerts?
Severity levels (note, warning, error) in Code Scanning alerts help teams prioritize which vulnerabilities to address first based on potential business and security impact.
When using CodeQL, what is the purpose of the 'CodeQL database'?
The CodeQL database is created during analysis by extracting and structuring information from the source code, allowing CodeQL queries to efficiently search for vulnerability patterns.
How should an organization handle a Secret Scanning alert for an exposed API key?
When a secret is exposed through Secret Scanning, it should be immediately revoked/rotated and removed from repository history using tools like git-filter-repo to prevent unauthorized access.
What is the relationship between GitHub Advanced Security and GitHub Enterprise Cloud?
GitHub Advanced Security is available through separate licensing and can be enabled for eligible repositories on both GitHub.com and GitHub Enterprise Cloud, not just on Enterprise Server.
When reviewing Code Scanning alerts, which CWE (Common Weakness Enumeration) would most commonly relate to SQL injection vulnerabilities?
CWE-89 specifically identifies SQL Injection weaknesses, while other CWEs address different vulnerability categories like XSS (CWE-79) or CSRF (CWE-352).
What configuration option allows GitHub Advanced Security to scan only specific code paths in a repository?
GitHub Actions workflows can use 'paths' and 'paths-ignore' filters to control which files trigger Code Scanning analysis, allowing targeted security scanning of critical code areas.
How does GitHub Advanced Security handle dependency scanning for indirect dependencies?
Dependabot and the Dependency graph scan the complete dependency tree, including indirect (transitive) dependencies, to identify vulnerabilities that could affect the application even through deep dependency chains.
When implementing Secret Scanning across an organization, what is the recommended approach for handling existing secrets in repository history?
Best practice involves scanning existing repositories to identify exposed secrets, removing them from history using appropriate tools, and rotating all exposed credentials to prevent unauthorized access.
What is the significance of the 'CodeQL CLI' for organizations implementing GitHub Advanced Security?
The CodeQL CLI enables developers to run CodeQL analysis locally, create databases, and test custom queries before committing, supporting a 'shift-left' security approach.
When configuring branch protection rules in GitHub Advanced Security, what is the primary purpose of requiring code reviews before merging?
Code reviews are a critical security control that enables peer review of changes before they are merged, helping catch vulnerabilities and maintain code quality standards.
Which GitHub Advanced Security feature allows you to identify and track dependencies with known vulnerabilities across your repositories?
Dependabot is GitHub's native dependency management tool that automatically detects vulnerable dependencies and can create pull requests to update them to patched versions.
You are reviewing a secret scanning alert that detected a hardcoded AWS access key in a commit from three weeks ago. What is the most critical immediate action you should take?
When a credential is exposed in version control, it must be immediately revoked to prevent unauthorized access, and usage should be audited to detect any malicious activity during the exposure window.
In the context of GitHub Advanced Security, what does SAST stand for and what is its primary function?
SAST tools like CodeQL in GitHub analyze source code statically to identify potential vulnerabilities, coding flaws, and security issues without needing to run the application.
You need to enable Code Scanning for a repository, but you want to use a custom CodeQL query to detect a specific pattern relevant to your organization. What is the correct approach?
GitHub allows organizations to create and maintain custom CodeQL queries within their repositories and reference them in GitHub Actions workflows via the `queries` parameter in the CodeQL action.
When interpreting Code Scanning results, what does a 'high' severity rating typically indicate?
High severity vulnerabilities indicate a significant security risk, typically allowing code execution, privilege escalation, or unauthorized data access with reasonable exploitation difficulty.
Which of the following best describes the relationship between GitHub Advanced Security and supply chain security?
GitHub Advanced Security is integral to supply chain security through Dependabot for dependency management, secret scanning to prevent credential compromise, and code scanning to ensure code quality.
An organization has enabled secret scanning on all repositories but wants to prevent false positives for test credentials. What is the recommended approach to handle legitimate non-production secrets?
Best practice is to use GitHub's native Secrets feature for legitimate credentials and configure custom secret patterns to reduce false positives while maintaining security.
When using GitHub's push protection feature (part of Advanced Security), at what point in the development workflow does it prevent credential exposure?
Push protection prevents developers from pushing commits containing secrets to any GitHub repository by blocking the push at the git level, the earliest possible intervention point.
In a mature GitHub Advanced Security implementation, how should security alerts from multiple features (Code Scanning, Dependabot, Secret Scanning) be prioritized for remediation?
Effective vulnerability management prioritizes by risk: high-severity findings in critical components that are easily exploitable should be addressed first, not arbitrary criteria.
You've reviewed all 60 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free