Microsoft GH-500 - GitHub Advanced Security Exam

Repository rulesets provide centralized enforcement of repository policies before changes can be merged. Rulesets can require workflows or status checks to succeed, and GitHub specifically supports security-oriented enforcement such as dependency review and code scanning merge protection. For dependency review, an organization can require the dependency review workflow through a ruleset so that vulnerable dependency changes prevent merging. Code scanning rulesets can likewise require acceptable code scanning results and define alert thresholds. “Security GuardRails” and “status enforcement” are not GitHub repository features with the functionality described here, while Insights is primarily used for repository statistics and reporting. Therefore, repository rulesets provide the policy mechanism needed to enforce these security gates before code reaches protected branches.

Comprehensive and Detailed Explanation:

When configuring Dependabot via the dependabot.yml file, the following fields are mandatory for each update configuration:

directory: Specifies the location of the package manifest within the repository. This tells Dependabot where to look for dependency files.​

package-ecosystem: Indicates the type of package manager (e.g., npm, pip, maven) used in the specified directory.​

schedule.interval: Defines how frequently Dependabot checks for updates (e.g., daily, weekly). This ensures regular scanning for outdated or vulnerable dependencies.​

The milestone field is optional and used for associating pull requests with milestones. The allow field is also optional and used to specify which dependencies to update.​

GitLab

Requesting a CVE ID for a security advisory in a GitHub repository requires Admin permissions. This level of access is necessary because it involves managing sensitive security information and coordinating with external entities to assign a CVE, which is a formal process that can impact the public perception and security posture of the project.​

To exclude .txt and .md files from triggering workflows on pull requests to the main branch:

on: defines the event (e.g., pull_request)

pull_request: is the trigger

paths-ignore: is the key used to ignore file patterns

Example YAML:

yaml

CopyEdit

on:

pull_request:

branches:

- main

paths-ignore:

- '*.md'

- '*.txt'

Using paths: would include only specific files instead — not exclude. paths-ignore: is correct here.

To systematically analyze newly introduced source code for security weaknesses, you should configure code scanning. GitHub code scanning can use CodeQL or supported third-party analysis tools and can run automatically when developers push changes or create pull requests. This places vulnerability detection directly into the development workflow rather than depending on manual review. The extended CodeQL query suite broadens the set of queries executed, but it only has an effect after code scanning itself is configured. CODEOWNERS determines who reviews specific paths and does not perform vulnerability analysis. A security policy explains how vulnerabilities should be reported but does not scan source code. Therefore, enabling and properly configuring code scanning is the foundational mechanism for ensuring new code is automatically analyzed.

Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.

This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.

GitHub allows organization owners and repository administrators to grant additional people or teams access to repository security alerts, including Dependabot alerts, but the recipients must already have write access to that repository. Users with write, maintain, or admin access can normally view relevant repository security alerts, while additional alert-access assignments are also constrained by repository access. A team that merely has Read access to another repository does not satisfy this requirement. Similarly, an outside collaborator with only Read access or an enterprise member who has not been assigned access to the repository cannot be granted the alert access described by the question. Therefore, members of a team that has Write access to the affected repository meet GitHub's permission requirement.

The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.

Simply deleting the secret from the code does not remove the risk if it hasn’t been revoked — especially since it may already be exposed in commit history.

GitHub Advanced Security features can be managed at both the organization and repository levels. Organization owners can control security configurations and Advanced Security access across repositories from the organization's Settings area. At the repository level, administrators can manage eligible security and analysis features through the repository's Settings, subject to any policies or security configurations enforced by the organization or enterprise. Current GitHub terminology separates Advanced Security into products such as GitHub Secret Protection and GitHub Code Security, but the same management hierarchy applies. The organization's Repository permissions area manages general repository access permissions rather than feature licensing or enablement, while enterprise settings primarily establish higher-level policies rather than directly serving as the normal per-repository control described here.

Validity checks , also called secret validation , allow GitHub to check if a detected secret is still active . If verified as live, the alert is marked as "valid" , allowing security teams to prioritize the most critical leaks.

Push protection blocks secrets but does not check their validity. Custom patterns are user-defined and do not include live checks.