GitHub Advanced Security Certification Pracice Test – All Questions

Browse all practice questions for the GitHub Advanced Security Certification Pracice Test. Search by topic, open any question and review its full explanation, then test yourself in the practice quiz.

Start practice test Flash cards

How Secret Scanning for Partners automatically flags secrets in public repos and reports findings to the partnerSecret Scanning for Partners operates how?How to handle a new dependency vulnerability: detect, triage, upgrade, test, publish advisories, and monitorWhich sequence best describes the typical workflow for handling a new vulnerability in dependencies?Understanding the four-phase rollout of GHAS and what it means for security tooling in organizationsHow many rollout phases are described for GHAS in the material?What to include in a public security advisory to help readers assess risk and take actionWhat details should be included when publishing a security advisory to the public?

More practice questions

These questions are part of the practice quiz. Start practicing

How do you verify the effectiveness of GAS remediation efforts over time?
Secret Scanning: which description best matches its function?
Direct Dependencies are which of the following?
Which feature reviews the security configuration and alerts for an organization and identifies the repositories at greater risk?
What is Dependabot Security Updates, and how does it integrate with GitHub Advanced Security?
Which option best describes Dependency Review?
Which statement best describes the role of SARIF in Code Scanning?
How can you assign advisories to a team for remediation?
Phase 1 involves piloting the initial rollout with a few high impact projects or teams.
Phase 1 duration ranges from 2 weeks to 3 months.
How can you suppress a Secret Scanning alert?
Explain the difference between a Code Scanning alert and a Dependabot alert.
What is the difference between Direct dependencies and Transitive dependencies in the context of Dependency Review?
How can you differentiate Code Scanning alerts from Secret Scanning alerts in the UI?
Environments are a focus area that primarily aims to do which of the following?
What is the difference between 'secret scanning' and 'secret detection' in GitHub Advanced Security?
Which term refers to grouping multiple CodeQL queries for easier management?
What are common secret patterns Secret Scanning looks for?
How does SBOM support supply chain security in GitHub Advanced Security?
What is the purpose of Secret Scanning in GAS?
What is GitHub Advanced Security?
How does GAS support compliance across a software supply chain?
Which primary focus area concerns the reliance on open-source software within repositories?
Custom patterns can include patterns internal to your organization.
What is the recommended sequence of actions after discovering a vulnerability in a dependency in GAS?
Which GitHub Advanced Security feature helps identify all dependencies used by a repository, including transitive dependencies?
What is an alert triage workflow and why is it important for GAS efficiency?
Explain how to interpret a Code Scanning alert's 'Severity' and 'Confidence' fields.
What is the recommended approach to minimize token exposure in GitHub Actions?
How can you disable scanning for a specific language or file type?
What is the role of a security policy in GitHub Advanced Security, and how does it guide responders?
Which mechanism can be used to suppress a Code Scanning alert via CodeQL?
What are triggers in a CodeQL workflow used for?
How can you export Code Scanning results for integration with external tools?
Phase 3 includes broad rollout and requires teams to understand the impact on workflows.
Which tool is used to generate a database representation of your codebase?
How can you customize CodeQL queries to target a specific library or framework in your project?
In a Code Scanning workflow, what type of results are uploaded after analysis?
Which statement about CodeQL scope is accurate?
What is the primary function of Code Scanning?
What happens if a dependency upgrade introduces a known vulnerability?
What are SARIF files used for in this context?
What is the recommended action when a secret is detected?
In security analysis, what is a primary use of the CodeQL database?
What method does GitHub's secret scanning primarily use to detect secrets?
How does GitHub compute vulnerable dependencies and show advisories?
What can Secret Scanning do in Git history?
What is a CodeQL query pack, and how is it used in Code Scanning?
How does GitHub's Code Scanning integrate with pull request checks?
How many languages does CodeQL support in GAS and how do you enable them?
How do you suppress a false positive in Code Scanning?
Which events typically trigger a Code Scanning workflow?
GitHub Advisory Database provides information on which of the following?
Where can advisories surfaced by vulnerability analysis be viewed in GitHub Advanced Security?
Which statement best describes GAS's approach to a compliant security process?
Who are the default receivers for secret scanning alerts?
How does GAS automatically assist with assigning reviewers for code changes?
Which feature allows defining custom patterns for secrets beyond the built-in set?
What is the typical duration of Phase 0?
What is CodeQL packs and how do they relate to queries?
What is the role of CodeQL scanning within pull request workflows?
How are rule severities configured for Code Scanning alerts?
What is the purpose of the Dependency Graph?
What does Security Overview provide?
What is the primary benefit of CodeQL packs in GitHub Advanced Security?
In GitHub Advanced Security, a security policy helps responders by guiding handling of advisories, alerts, and incident workflows.
What is the process for triaging a Code Scanning alert?
What is the primary function of declarative specifications?
What is a CodeQL workflow file and what are its key sections?
Where is the SBOM stored after generation?
What is the purpose of Dependency Review in GAS?
What is the relationship between Code Scanning and repository vulnerability advisories?
Where is SBOM data surfaced in GitHub to aid vulnerability assessment and supply chain risk analysis?
How can you limit the scope of CodeQL analysis to specific languages or paths?
How are custom CodeQL queries added to Code Scanning?
Which of the following is listed as an example of partners for Secret Scanning?
How can you use the SBOM to respond to a zero-day vulnerability?
Which languages are supported by CodeQL for Code Scanning's analysis beyond the core languages?
What practice best ensures coordination with teams when responding to a vulnerability in GAS?
How can SBOM aid in license compliance?
What is a Security Advisory used for?
What is a CycloneDX SBOM and why is it important?
What is the purpose of paths-ignore in secret scanning configuration?
Which statement about Private Repositories is true?
Which statement best describes CodeQL scanning in PRs?
Shift-Left in GitHub Advanced Security refers to which concept?
How can you enforce Code Scanning results before merging using branch protection?
Expressiveness describes which of the following?
Push Protection for Secrets is primarily concerned with preventing commits to which branch when a secret is identified?
What is the purpose of creating private advisories in GAS?
Which type of secret pattern is looked for by Secret Scanning?
What does CodeQL CLI provide?
How would you suppress a known false positive in Code Scanning?
What are the typical steps in triaging a Code Scanning alert?
What are query language packs used to organize the files used in CodeQL analysis?
Which is NOT a valid type of query suite?
Indirect Dependencies are also known as which term?
What is the difference between a private vulnerability advisory and a public one?
Phase 3 focuses on full organizational rollout and change management.
How many types of query suites are there?
Which combination of practices helps prevent secrets from being committed?
How can you customize Code Scanning to focus on specific files or paths?
Which of the following languages is NOT listed as supported by CodeQL queries for Code Scanning?
The process of using a known security vulnerability as a seed to find similar problems in your code is called?
In GHAS, what does Automated refer to?
How do you enable and configure Code Scanning in a GitHub repository?
What is the purpose of Custom Patterns in secret scanning?
How can you view Dependency Review results in a PR?
What does Scrub do in a repository?
What is a CodeQL database, and how is it used in code scanning?
Which tool is used to test CodeQL queries locally before pushing to GitHub?
Explain the role of 'Code scanning alerts' in pull request reviews.
How do you enable Code Scanning with CodeQL for a repository on GitHub?
Secret refers to which category?
What is the primary purpose of SECURITY.md?
How does Dependency Review work in GitHub Advanced Security?
How does Dependency Review highlight vulnerable or license-risky dependencies?
What is a practical way GAS results can be connected to ongoing work items?
Dependencies refer to which concept in the project?
What is the purpose of code scanning alerts triage, and what steps are typical?
What is a key benefit of Code Scanning with CodeQL?
Which feature allows you to pass multiple queries to CodeQL without specifying the path to each query file individually?
How do you configure secret scanning to ignore certain patterns or allowlist certain strings?
How do you interpret SBOM results for risk prioritization?
What is the CodeQL database creation step, and what inputs does it require?
Dependabot Alerts are designed to do what?
Which of the following statements about SBOM is most accurate?
Which tool is described as a powerful tool used to remove passwords or renaming of specific files or file sets?
What is SBOM, and why is it important in GitHub Advanced Security?
Which of the following lists the four primary features of GitHub Advanced Security?
How does GAS certification assess understanding of incident response?
Which scenario demonstrates SBOM value for license compliance?
Where is the suppression file for Code Scanning commonly placed?
What is a SARIF file, and how is it used in GitHub's security workflow?
Which format enables code scanning alerts from third-party tools in the repository?
How can you run CodeQL analysis locally to test queries before pushing to GitHub?
What is considered a secret?
Dependabot Security Updates will
What are best practices for maintaining CodeQL queries and monitoring new vulnerabilities?
Which statement correctly describes Scrub and BFG Repo-Cleaner?
Which of the following is a trait of GHAS?
What activity helps ensure ongoing effectiveness after enabling GAS?
Phase 2 is titled Organizational Buy In.
Which statement about Code Scanning findings is accurate?
What best describes the primary technique used by CodeQL to identify vulnerabilities?
What is CodeQL?
Which of the following is an example of partners?
What does the Dependency Review/Graph feature provide?
What do Extractors provide in the CodeQL workflow?
Code-scanning Queries run by default in CodeQL code scanning on GitHub. Which term describes these default queries?
Which statement about Public Repositories is true?
What must you enable in GitHub for Dependabot to work?
Phase 0 in GHAS rollout focuses on what?
What triggers Code Scanning runs?
Dependabot Security Updates automatically do what?
What does CVE stand for?
What is the recommended timing for public disclosure of a vulnerability via a Security Advisory?
In GitHub Advanced Security, what is an advisory and how does Dependabot use advisories?
Dependents refer to what in the project context?
The rollout process begins with Phase 0 and ends with Phase 3.
Which practice helps reduce the risk of false negatives in CodeQL scanning?
Which best describes Dependabot's role?
Which statement accurately describes the purpose of CodeQL within GitHub Advanced Security?
Where is codeql-suppressions.yml typically stored?
Which components are typically included in a GitHub Advanced Security Code Scanning workflow file?
What is a 'false negative' in this context, and how can it be mitigated?
How do you enable SBOM generation in GAS?
What is Dependency Graph, and why is it required for Dependency Review and Dependabot?
Which set includes extra maintainability and reliability queries?
Which of the following should be kept up-to-date to maintain CodeQL effectiveness?
What is a Security Advisory in GitHub and how do you create a private one?
What does the CodeQL setup step do in a Code Scanning workflow?
How do you use Code Owners in GAS to assign security-related fixes?
Secret Scanning is automatically performed on which type of repositories?
What is CodeQL in the context of GitHub Advanced Security, and what is its primary purpose?
Enabling Dependabot security updates in a repository results in which of the following?
What is the role of Extractors?
Dependabot Alerts are generated automatically when a new vulnerable dependency is found.
Which statement best describes CodeQL in Code Scanning?
Which statement best describes how Code Scanning findings relate to remediation?
How can you measure the impact of enabling GAS in a project?
What is the process to publish a security advisory to the public?
What is SBOM generation and usage in GAS used for?
What is codeql-suppressions.yml used for?
Dependabot Version Updates automatically perform which of the following?
Vendor Dependencies: Where are vendor dependencies stored?
What file formats are produced by Code Scanning results, and how are they used within GitHub?
Where are security advisories created in GitHub Advanced Security (GAS)?
What is a SARIF rule in Code Scanning?
What are the benefits of using a centralized CodeQL repository for queries?
What is the BFG Repo-Cleaner used for?
Secret Scanning for Users provides alerts to users when which condition is met?
Which component runs the CodeQL queries during Code Scanning?
What should Dependency Review summarize in a PR?
Which type includes extra securities with slightly lower precision and severity?
Which sequence best describes the lifecycle of a security advisory in GHAS?
After addressing a high-severity Code Scanning alert, what is the recommended final step?
Which feature highlights issues in specific locations of your code?
Which capability does GAS provide concerning dependencies and risk?
Which set includes queries from both code-scanning and security-extended plus extra maintainability and reliability queries?
How do you assign CVSS scores to advisories?
Which file is used to configure CodeQL languages?
How do you document and communicate remediation progress to stakeholders?
How can CodeQL queries stay up-to-date with new languages and patterns?
The statistic that 94% of code repositories rely on open-source software highlights which focus area?
What is Dependabot?
What is CodeQL and how is it used in GAS?
What is the primary purpose of SARIF in GitHub's security workflow?
Which ecosystems are commonly covered by Dependency Review?
What does SBOM enable regarding license compliance?
How can GAS results be integrated with external issue trackers?
Which feature runs by default in CodeQL code scanning on GitHub?
Which statement about Dependabot alerts and Dependabot security updates is accurate?
REST API in this context retrieves information about actions up to how many days old?
Which combination correctly lists the three primary areas of focus in GitHub Advanced Security?
What is a CodeQL query pack and what is its role in scanning?
What are the limitations of pattern-based secret detectors?
As part of maintaining CodeQL integration, what should be reviewed periodically?
How can you view a list of all dependencies and their known vulnerabilities for a repository in GitHub Advanced Security?
How do you export or view Code Scanning results outside the GitHub UI?
Where are Code Scanning alerts displayed in the GitHub user interface?
Which statement best describes how to stay current with CodeQL languages and patterns?
What is Autobuild used for?
What does git filter-repo do?
What are the recommended language coverage and scanning frequency for CodeQL in a typical GitHub repository using GAS?
After Phase 1, which phase follows?
How does Dependabot determine the target version for upgrades?
What happens if a vulnerability is found during Dependency Review?
What is SECURITY.md?
Name at least three languages supported by CodeQL queries for Code Scanning.
How can you prevent secrets from being committed in the first place?
Code is a focus area that helps developers achieve which outcome?
Which best practices improve the security of GitHub Actions workflows?
Which feature describes the flow of information between a source and a sink in your code?
What is a 'false positive' in the context of Code Scanning, and how should you handle it?
Which format does Code Scanning use to report results, and what is its purpose?

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy