Free GitHub GitHub-Advanced-Security Exam Dumps Questions & Answers

Why should you dismiss a code scanning alert?

• A.  To prevent developers from introducing new problems
• B.  If there is a production error in your code
• C.  If you fix the code that triggered the alert
• D.  If it includes an error in code that is used only for testing

Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)

• A.  commit
• B.  trigger
• C.  workflow_dispatch
• D.  pull_request

Which of the following formats are used to describe a Dependabot alert? (Each answer presents a complete solution. Choose two.)

• A.  Common Weakness Enumeration (CWE)
• B.  Common Vulnerabilities and Exposures (CVE)
• C.  Vulnerability Exploitability exchange (VEX)
• D.  Exploit Prediction Scoring System (EPSS)

After investigating a code scanning alert related to injection, you determine that the input is properly sanitized using custom logic. What should be your next step?

• A.  Dismiss the alert with the reason "false positive."
• B.  Open an issue in the CodeQL repository.
• C.  Draft a pull request to update the open-source query.
• D.  Ignore the alert.

Which details do you have to provide to create a custom pattern for secret scanning? (Each answer presents part of the solution. Choose two.)

• A.  Additional match requirements for the secret format
• B.  The name of the pattern
• C.  A list of repositories to scan
• D.  The secret format