First Attempt Guaranteed Success in GitHub-Advanced-Security Exam 2025 [Q28-Q50]

5/5 - (4 votes)

First Attempt Guaranteed Success in GitHub-Advanced-Security Exam 2025

Real GitHub-Advanced-Security Exam Questions are the Best Preparation Material

GitHub GitHub-Advanced-Security Exam Syllabus Topics:

Topic	Details
Topic 1	Describe GitHub Advanced Security best practices: This section of the exam measures skills of a GitHub Administrator and covers outlining recommended strategies for adopting GitHub Advanced Security at scale. Test?takers will explain how to apply security policies, enforce branch protections, shift left security checks, and use metrics from GHAS tools to continuously improve an organization’s security posture.
Topic 2	Configure GitHub Advanced Security tools in GitHub Enterprise: This section of the exam measures skills of a GitHub Administrator and covers integrating GHAS features into GitHub Enterprise Server or Cloud environments. Examinees must know how to enable advanced security at the enterprise level, manage licensing, and ensure that scanning and alerting services operate correctly across multiple repositories and organizational units.
Topic 3	Configure and use code scanning: This section of the exam measures skills of a DevSecOps Engineer and covers enabling and customizing GitHub code scanning with built?in or marketplace rulesets. Examinees must know how to interpret scan results, triage findings, and configure exclusion or override settings to reduce noise and focus on high?priority vulnerabilities.

Q28. When configuring code scanning with CodeQL, what are your options for specifying additional queries?
(Each answer presents part of the solution. Choose two.)

Packs

github/codeql

Scope

Queries

Q29. What is required to trigger code scanning on a specified branch?

The repository must be private.

Secret scanning must be enabled on the repository.

Developers must actively maintain the repository.

The workflow file must exist in that branch.

Q30. Which syntax in a query suite tells CodeQL to look for one or more specified .ql files?

query

qlpack

qls

Q31. Which Dependabot configuration fields are required? (Each answer presents part of the solution. Choose three.)

directory

package-ecosystem

milestone

schedule.interval

allow

Q32. Which CodeQL query suite provides queries of lower severity than the default query suite?

github/codeql-go/ql/src@main

github/codeql/cpp/ql/src@main

security-extended

Q33. As a developer with write access, you navigate to a code scanning alert in your repository. When will GitHub close this alert?

After you triage the pull request containing the alert

When you use data-flow analysis to find potential security issues in code

After you find the code and click the alert within the pull request

After you fix the code by committing within the pull request

Q34. Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?

Dependabot reviews manifest files in the repository

CodeQL analyzes the code and raises vulnerabilities in third-party dependencies

A dependency graph is created, and Dependabot compares the graph to the GitHub Advisorydatabase

The build tool finds the vulnerable dependencies and calls the Dependabot API

Q35. What is a security policy?

An automatic detection of security vulnerabilities and coding errors in new or modified code

A security alert issued to a community in response to a vulnerability

A file in a GitHub repository that provides instructions to users about how to report a security vulnerability

An alert about dependencies that are known to contain security vulnerabilities

Q36. What does a CodeQL database of your repository contain?

A build for Go projects to set up the project

A build of the code and extracted data

Build commands for C/C++, C#, and Java

A representation of all of the source code GitHub Agentic AI for AppSec Teams

Q37. What role is required to change a repository’s code scanning severity threshold that fails a pull request status check?

Maintain

Write

Triage

Admin

Q38. Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)

pull_request

workflow_dispatch

trigger

commit

Q39. Where in the repository can you give additional users access to secret scanning alerts?

Security

Settings

Secrets

Insights

Q40. Where can you use CodeQL analysis for code scanning? (Each answer presents part of the solution. Choose two.)

In a third-party Git repository

In a workflow

In an external continuous integration (CI) system

In the Files changed tab of the pull request

Q41. Which of the following Watch settings could you use to get Dependabot alert notifications? (Each answer presents part of the solution. Choose two.)

The Custom setting

The Participating and @mentions setting

The All Activity setting

The Ignore setting

Q42. If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?

Users with Write permissions to the repository

Users with Admin privileges to the repository

Users with Maintain privileges to the repository

Users with Read permissions to the repository

Q43. Which alerts do you see in the repository’s Security tab? (Each answer presents part of the solution. Choose three.)

Repository permissions

Secret scanning alerts

Dependabot alerts

Security status alerts

Code scanning alerts

Q44. What happens when you enable secret scanning on a private repository?

Repository administrators can view Dependabot alerts.

Your team is subscribed to security alerts.

GitHub performs a read-only analysis on the repository.

Dependency review, secret scanning, and code scanning are enabled.

Q45. Which of the following information can be found in a repository’s Security tab?

Number of alerts per GHAS feature

Two-factor authentication (2FA) options

Access management

GHAS settings

Q46. Which of the following is the best way to prevent developers from adding secrets to the repository?

Create a CODEOWNERS file

Make the repository public

Configure a security manager

Enable push protection

Q47. What does code scanning do?

It contacts maintainers to ask them to create security advisories if a vulnerability is found

It prevents code pushes with vulnerabilities as a pre-receive hook

It analyzes a GitHub repository to find security vulnerabilities

It scans your entire Git history on branches present in your GitHub repository for any secrets

Q48. Which security feature shows a vulnerable dependency in a pull request?

Dependency graph

Dependency review

Dependabot alert

The repository’s Security tab

Q49. Which of the following options are code scanning application programming interface (API) endpoints? (Each answer presents part of the solution. Choose two.)

List all open code scanning alerts for the default branch

Modify the severity of an open code scanning alert

Get a single code scanning alert

Delete all open code scanning alerts

Q50. As a repository owner, you do not want to run a GitHub Actions workflow when changes are made to any .txt or markdown files. How would you adjust the event trigger for a pull request that targets the main branch?
(Each answer presents part of the solution. Choose three.)
* on:
* pull_request:
* branches: [main]

– ‘/*.md’

– ‘/*.txt’

paths:

paths-ignore:

– ‘docs/*.md’