Microsoft GH-500 - GitHub Advanced Security Exam

A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.

Simply generating a PR or passing checks does not change the alert status; merging is the key step.

Enabling the dependency graph allows GitHub to analyze supported manifest and lock files and build a representation of the repository's direct and transitive dependencies. GitHub receives read-only access to the dependency files, parses supported manifests when the feature is first enabled, and then updates the graph as repository content changes. Dependabot alerts and Dependabot security updates are separate capabilities: enabling the dependency graph alone does not automatically mean that security-update pull requests will be generated. Likewise, the dependency graph setting for one repository does not require administrators to manually enable dependency information for every newly created repository unless their organization's configuration requires that behavior. Therefore, the applicable result among the supplied options is that repository administrators can view the dependency information exposed by the dependency graph.

To detect and block vulnerable dependencies before merge , developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.

This is a preventative measure during development, unlike Dependabot, which reacts after the fact .

GitHub identifies repository administrators as users who can enable Dependabot alerts for an individual repository. Organization owners can also enable the feature at organization scope, but they are not one of the options presented. Once enabled, Dependabot compares dependency information against vulnerability data from the GitHub Advisory Database and generates alerts when affected dependencies are found. Users with Maintain or Write access can view and work with alerts when permissions allow, but enabling or disabling repository security features requires repository administration privileges under the configuration model tested here. Outside collaborators do not automatically receive that level of administrative control, and “security analyst” is not a standard repository role granting feature-enablement authority. Therefore, repository administrator is the correct selection.

Comprehensive and Detailed Explanation:

Dependency review is triggered by specific events in GitHub workflows:​

pull_request: When a pull request is opened, synchronized, or reopened, GitHub can analyze the changes in dependencies and provide a dependency review.​

workflow_dispatch: This manual trigger allows users to initiate workflows, including those that perform dependency reviews.​

The trigger and commit options are not recognized GitHub Actions events and would not initiate a dependency review.​

When a person's access to a private repository is removed, GitHub deletes that person's private forks belonging to the repository's network. This prevents the GitHub-hosted fork from remaining available after the user loses authorization to the upstream private repository. GitHub cannot, however, automatically erase local clones that the person previously downloaded to their own computers; the documentation explicitly states that local clones are retained. Removing one individual's access also does not necessarily revoke an entire team's access, because team permissions are managed separately. Nor does GitHub automatically delete confidential information that may have been copied outside the repository. GitHub therefore advises organizations to ensure that former collaborators appropriately dispose of confidential or proprietary information. The direct platform behavior described in the question is deletion of the user's private forks.

Under GitHub's current documented behavior, the minimum repository permission that can bypass ordinary repository push protection is Write, making B correct. GitHub states that, when delegated bypass is not enabled, a contributor with write access can bypass a push-protection block by providing an allowed reason. The bypass is recorded, and repository-level push protection can generate a corresponding alert and audit-log entry. The PDF marks Admin, which reflects older or more restrictive behavior and is no longer the best answer under current GitHub documentation. Organizations can also enable delegated bypass, which changes the model by requiring contributors without bypass privileges to request approval from designated reviewers. Organization owners, security managers, or specifically authorized roles can then manage those requests. For the default non-delegated model, Write is sufficient.

Query suite definitions in CodeQL are stored using the .qls file extension. A query suite defines a collection of queries to be run during an analysis and allows for grouping them based on categories like language, security relevance, or custom filters.

In contrast:

.ql files are individual queries.

.qll files are libraries used by .ql queries.

.yml is used for workflows, not query suites.

A custom CodeQL configuration file can be stored in an external repository and referenced by multiple repositories. This allows an organization to centralize query packs, additional queries, query filters, path exclusions, threat-model configuration, and other CodeQL settings rather than duplicating the same settings across many workflow files. GitHub explicitly documents centralized configuration as a benefit of external configuration files. A token may be required when an advanced-setup workflow retrieves a configuration file from a private external repository, but providing the token is not the purpose of the configuration file itself. Likewise, a configuration file does not automatically choose a package, and query packs do not inherently disable the default query suite. Default queries are disabled only when the appropriate configuration option is deliberately specified. Therefore, C is correct.

The Allow for all organizations policy permits repository administrators throughout organizations owned by the enterprise to enable applicable Advanced Security capabilities on their repositories. GitHub enterprise policy can determine whether repository administrators are allowed to enable GitHub Secret Protection, GitHub Code Security, or legacy GitHub Advanced Security features. Selecting an option limited to chosen organizations would restrict availability rather than permit it enterprise-wide. A prohibition such as Never allow would prevent repository administrators from enabling the feature, while No policy does not explicitly establish the enterprise-wide permission requested. GitHub's current documentation describes this policy as controlling availability across all organizations or specified organizations, with organization owners and security managers retaining broader security-management capabilities. Therefore, B matches the stated requirement to allow repository administrators throughout all enterprise organizations.