Microsoft GH-500 Online Practice Questions and Exam Preparation

Microsoft GH-500 Online Questions & Answers

• Question 1:

  Which CodeQL query suite provides queries of lower severity than the default query suite?

  A. github/codeql/cpp/ql/src@main
  B. security-extended
  C. github/codeql-go/ql/src@main
  B. security-extended

  ---

  Explanation

  The security-extended query suite includes additional CodeQL queries that detect lower severity issues than those in the default security-and-quality suite.

  About CodeQL query suites

  With CodeQL code scanning, you can select a specific group of CodeQL queries, called a CodeQL query suite, to run against your code. The following built-in query suites are available through GitHub:

  default query suite.

  security-extended query suite. This suite is referred to as the "Extended" query suite on GitHub. Currently, both the default query suite and the security-extended query suite are available for default setup for code scanning.

• Question 2:

  If default code security settings have not been changed at the repository, organization, or enterprise level, which repositories receive Dependabot alerts?

  A. private repositories
  B. none
  C. repositories owned by an organization
  D. repositories owned by an enterprise account
  B. none

  ---

  Explanation

  When Dependabot detects vulnerable dependencies in your repositories, we generate a Dependabot alert and display it on the Security tab for the repository. GitHub notifies the maintainers of affected repositories about the new alert

  according to their notification preferences. Dependabot is enabled by default on all public repositories, and needs to be enabled on private repositories.

  Note:

  By default, no repositories receive Dependabot alerts unless configuration is explicitly enabled. GitHub does not enable Dependabot alerts automatically for any repositories unless:

  The feature is turned on manually

  It's configured at the organization or enterprise level via security policies

  This includes public, private, and enterprise-owned repositories --manual activation is required.

• Question 3:

  What is code scanning?

  A. a feature to identify all your project's dependencies
  B. a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors
  C. a feature to privately discuss, fix, and publish information about security vulnerabilities in your repository
  D. a feature that scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally
  B. a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors

  ---

  Explanation

  GitHub's Code scanning is a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors, providing alerts in the repository and offering tools to triage, prioritize, and fix issues. It acts as a Static Application Security Testing (SAST) tool, using engines like CodeQL to detect issues like SQL injection and Cross-Site Scripting (XSS), and can be triggered automatically on events like pushes and pull requests.

  https://docs.github.com/github/finding-security-vulnerabilities-and-errors-in-your-code

• Question 4:

  What YAML syntax do you use to exclude certain files from secret scanning?

  A. paths-ignore:
  B. secret_scanning.yml
  C. branches-ignore:
  D. decrypt_secret.sh
  A. paths-ignore:

  ---

  Explanation

  Excluding folders and files from secret scanning

  You can customize secret scanning to automatically close alerts for secrets found in specific directories or files by configuring a secret_scanning.yml file in your repository.

  Under Edit new file, type paths-ignore: followed by the paths you want to exclude from secret scanning. This tells secret scanning to automatically close alerts for everything in the docs directory.

• Question 5:

  Where can a user change a repository's code scanning severity threshold that fails a pull request status check?

  A. Settings tab
  B. Actions tab
  C. Security tab
  D. Pull Requests tab
  C. Security tab

  ---

  Explanation

  Code scanning can now be set up to never cause a pull request check failure.

  By default, any code scanning alerts with a security-severity of critical or high will cause a pull request check failure.

  You can specify which security-severity level for code scanning results should cause the code scanning check to fail, including None, by going to the Code security and Analysis tab in the repository settings.

  https://github.blog/changelog/2023-02-06-code-scanning-can-be-set-up-not-to-fail-a-pull-request-check

• Question 6:

  A secret scanning alert should be closed as "used in tests" when a secret is:

  A. in a test file.
  B. solely used for tests.
  C. in the readme.md file.
  D. not a secret in the production environment.
  B. solely used for tests.

  ---

  Explanation

  If a secret is intentionally used in a test environment and poses no real-world security risk, you may close the alert with the reason"used in tests". This helps reduce noise and clarify that the alert was reviewed and accepted as non-critical. Just being in a test file isn't enough unless itspurpose is purely for testing.

• Question 7:

  Which of the following statements best describes secret scanning push protection?

  A. Buttons for sensitive actions in the GitHub UI are disabled.
  B. Commits that contain secrets are blocked before code is added to the repository.
  C. Users need to reply to a 2FA challenge before any push events.
  D. Secret scanning alerts must be closed before a branch can be merged into the repository.
  B. Commits that contain secrets are blocked before code is added to the repository.

  ---

  Explanation

  Secret scanning push protection is a security feature that prevents sensitive information like API keys or tokens from being pushed to a repository in the first place. It works by proactively scanning code during the push process and blocking any attempts to commit secrets. This differs from regular secret scanning, which only detects secrets after they have been committed.

• Question 8:

  A repository's dependency graph includes:

  A. annotated code scanning alerts from your repository's dependencies.
  B. dependencies from all your repositories.
  C. a summary of the dependencies used in your organization's repositories.
  D. dependencies parsed from a repository's manifest and lock files.
  D. dependencies parsed from a repository's manifest and lock files.

  ---

  Explanation

  The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems, as well as any dependencies that are submitted using the dependency submission API. This includes:

  Direct dependencies, that are explicitly defined in a manifest or lock file or have been submitted using the dependency submission API.

  Indirect dependencies of these direct dependencies, also known as transitive dependencies or sub- dependencies.

• Question 9:

  As a developer, you need to configure a code scanning workflow for a repository where GitHub Advanced Security is enabled. What minimum repository permission do you need?

  A. Read
  B. Admin
  C. None
  D. Write
  D. Write

  ---

  Explanation

  Configuring advanced setup for code scanning with CodeQL

  You can customize your CodeQL analysis by creating and editing a workflow file. Selecting advanced setup generates a basic workflow file for you to customize using standard workflow syntax and specifying options for the CodeQL action.

  See Workflows and Customizing your advanced setup for code scanning.

  Using actions to run code scanning will use minutes.

  Note

  You can configure code scanning for any public repository where you have write access.

• Question 10:

  Which of the following options would close a Dependabot alert?

  A. viewing the dependency graph
  B. leaving the repository in its current state
  C. creating a pull request to resolve the vulnerability that will be approved and merged
  D. viewing the Dependabot alert on the Dependabot alerts tab of your repository
  C. creating a pull request to resolve the vulnerability that will be approved and merged

  ---

  Explanation

  To close a Dependabot alert, the primary method is to address the underlying vulnerability. This usually involves merging a pull request that Dependabot creates to update the vulnerable dependency or manually fixing the issue and pushing the updated code. Once the vulnerability is resolved, the alert will be automatically closed. Alternatively, you can manually close alerts in the "Security" tab of your repository.

  Here's a more detailed breakdown:

  1.Addressing the Vulnerability:

  Merge Dependabot Pull Requests:

  If Dependabot has identified a vulnerability and created a pull request to fix it, review and merge the pull request. This will automatically update the dependency and close the alert.

  Manual Fix:

  If you prefer to fix the vulnerability yourself, make the necessary code changes to update the dependency. Once the changes are pushed and merged, Dependabot will recognize the fix and close the alert.

  2.Manually Closing Alerts (if needed)