Certbie

Free practice · No sign-up required

GitHub Advanced Security free practice test

15 questions with answer explanations. Choose an answer below to begin.

Question 1 of 15

What does GitHub Advanced Security primarily help organizations identify?

Show hint

Identify core security features of GitHub Advanced Security

0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.

Learn by doing

Put your answers into practice

Use official documentation and hands-on labs to work through topics you missed.

Explore all study resources →

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

  1. Question 1

    Link to question

    What does GitHub Advanced Security primarily help organizations identify?

    1. Security vulnerabilities and secrets in code

    2. User activity logs for compliance

    3. License compatibility issues

    4. Merge conflict resolutions

    Show answer and explanation

    Correct answer

    • Security vulnerabilities and secrets in code

    GitHub Advanced Security focuses on detecting security vulnerabilities and secrets within repositories. It uses code scanning and secret scanning to find issues early. This helps maintain a secure codebase before deployment.

  2. Question 2

    Link to question

    Which feature scans pull requests for known security vulnerabilities?

    1. Code scanning

    2. Secret scanning

    3. Dependency review

    4. Branch protection

    Show answer and explanation

    Correct answer

    • Code scanning

    Code scanning automatically analyzes code changes in pull requests for security vulnerabilities. It helps developers find and fix issues before merging. This proactive review improves overall code quality and security.

  3. Question 3

    Link to question

    What type of information does secret scanning look for in repositories?

    1. API keys and passwords

    2. Code complexity metrics

    3. Performance bottlenecks

    4. Documentation errors

    Show answer and explanation

    Correct answer

    • API keys and passwords

    Secret scanning detects sensitive information such as API keys, passwords, and tokens accidentally committed to the repository. It helps prevent credential leaks and unauthorized access. Early detection reduces the risk of security incidents.

  4. Question 4

    Link to question

    Which feature provides insights into the security of open source dependencies?

    1. Dependency review

    2. Code scanning

    3. Actions cache

    4. Workflow runs

    Show answer and explanation

    Correct answer

    • Dependency review

    Dependency review helps identify vulnerabilities in open source dependencies used within a project. It evaluates the security posture of these components. This ensures that known issues in third-party libraries are addressed promptly.

  5. Question 5

    Link to question

    What is required to enable GitHub Advanced Security features for a repository?

    1. A repository in an eligible GitHub plan

    2. A verified admin account

    3. A custom domain configured

    4. A public repository only

    Show answer and explanation

    Correct answer

    • A repository in an eligible GitHub plan

    GitHub Advanced Security features are available based on the GitHub plan and repository visibility settings. You must ensure the repository is part of an eligible plan and properly configured. Checking plan eligibility is the first step to activation.

  6. Question 6

    Link to question

    Which security practice involves reviewing code changes before they are merged?

    1. Pull request review

    2. Branch protection

    3. Commit signing

    4. Tag management

    Show answer and explanation

    Correct answer

    • Pull request review

    Pull request review allows team members to inspect code changes for security and quality issues. When combined with automated scanning, it strengthens the review process. This practice helps catch problems early in the development lifecycle.

  7. Question 7

    Link to question

    What does code scanning use to identify potential security issues?

    1. Analysis tools and queries

    2. User feedback forms

    3. External audit reports

    4. Manual code inspection

    Show answer and explanation

    Correct answer

    • Analysis tools and queries

    Code scanning utilizes configurable analysis tools and queries to detect patterns associated with security vulnerabilities. These tools run automatically on code changes. This automation ensures consistent and reliable security checks.

  8. Question 8

    Link to question

    Which feature helps prevent accidental exposure of credentials in code history?

    1. Secret scanning

    2. Code scanning

    3. Audit logs

    4. Protected environments

    Show answer and explanation

    Correct answer

    • Code scanning

    Secret scanning identifies and alerts on credentials and sensitive data committed to the repository. It can also help remediate exposed secrets by rotating them. This reduces the risk of compromised accounts due to leaked information.

  9. Question 9

    Link to question

    What is a benefit of using dependency review in GitHub Advanced Security?

    1. Identifies vulnerable open source components

    2. Improves code formatting consistency

    3. Automates deployment pipelines

    4. Generates API documentation

    Show answer and explanation

    Correct answer

    • Identifies vulnerable open source components

    Dependency review highlights known vulnerabilities in third-party libraries used by the project. It provides visibility into the security health of dependencies. Addressing these issues helps prevent supply chain attacks.

  10. Question 10

    Link to question

    Which statement best describes the role of GitHub Advanced Security in the development lifecycle?

    1. It integrates security checks early and often

    2. It replaces the need for manual testing

    3. It focuses solely on production monitoring

    4. It manages user access permissions

    Show answer and explanation

    Correct answer

    • It integrates security checks early and often

    GitHub Advanced Security embeds security into the development workflow by providing automated checks during coding and pull requests. This shift-left approach helps catch issues before they reach production. It complements rather than replaces other testing practices.

  11. Question 11

    Link to question

    What type of alerts can be managed within GitHub Advanced Security settings?

    1. Security alerts and code scanning results

    2. Billing alerts and usage metrics

    3. Workflow notifications and builds

    4. Repository fork events

    Show answer and explanation

    Correct answer

    • Security alerts and code scanning results

    GitHub Advanced Security provides a centralized location to manage security alerts generated from code scanning and secret scanning. These alerts help teams track and remediate issues. Managing them ensures timely response to potential risks.

  12. Question 12

    Link to question

    Which feature allows teams to define custom security rules for scanning?

    1. Custom queries

    2. Branch policies

    3. Environment secrets

    4. Code owners

    Show answer and explanation

    Correct answer

    • Custom queries

    Custom queries enable teams to tailor code scanning rules to their specific security requirements. This flexibility helps address unique risks in different projects. Teams can create queries to detect patterns not covered by default rules.

  13. Question 13

    Link to question

    What is a common outcome of enabling secret scanning in a repository?

    1. Alerts for exposed secrets in commits

    2. Automatic deletion of old commits

    3. Increased repository storage

    4. Restricted branch permissions

    Show answer and explanation

    Correct answer

    • Alerts for exposed secrets in commits

    Enabling secret scanning results in alerts when sensitive data such as tokens or keys are detected in the repository history. This allows teams to respond quickly by rotating credentials. It is a proactive measure to prevent unauthorized access.

  14. Question 14

    Link to question

    Which of the following is a best practice when using GitHub Advanced Security features?

    1. Regularly review and remediate alerts

    2. Disable scanning for public repositories

    3. Ignore low-severity findings

    4. Rely only on automated tools

    Show answer and explanation

    Correct answer

    • Regularly review and remediate alerts

    Regularly reviewing and addressing alerts ensures that vulnerabilities are managed effectively. This practice helps maintain a strong security posture over time. Combining automated tools with human review yields the best results.

  15. Question 15

    Link to question

    What is the primary purpose of the dependency graph in GitHub Advanced Security?

    1. To visualize the network of contributors in a repository

    2. To track and manage open source dependencies and their vulnerabilities

    3. To monitor the performance of CI/CD pipelines

    4. To store historical versions of code for rollback purposes

    Show answer and explanation

    Correct answer

    • To track and manage open source dependencies and their vulnerabilities

    The dependency graph identifies dependencies and known vulnerabilities, helping secure the software supply chain.

Read all flashcards

Recall the answer before opening each card.

What does GitHub Advanced Security primarily help identify?

Security vulnerabilities and secrets in code.

Which feature scans pull requests for known security vulnerabilities?

Code scanning. It analyzes code changes for vulnerabilities.

What type of information does secret scanning look for?

API keys, passwords, and tokens accidentally committed.

Which feature provides insights into open source dependency security?

Dependency review. It identifies vulnerabilities in third-party libraries.

What is required to enable GitHub Advanced Security for a repository?

An eligible GitHub plan (Enterprise) and proper configuration.

Which practice involves reviewing code changes before merging?

Pull request review, often combined with automated scanning.

What does code scanning use to identify potential security issues?

Analysis tools and queries like CodeQL.

Which feature helps prevent accidental exposure of credentials in code history?

Secret scanning alerts and rotates exposed credentials.

What is a benefit of using dependency review?

Identifies vulnerable open source components in pull requests.

What is the role of GitHub Advanced Security in the development lifecycle?

Integrates security checks early and often (shift-left).

What alerts can be managed in GitHub Advanced Security settings?

Security alerts from code scanning and secret scanning.

Which feature allows defining custom security rules for scanning?

Custom queries in code scanning (CodeQL).

What is a common outcome of enabling secret scanning?

Alerts for exposed secrets in commits.

What is a best practice when using GitHub Advanced Security?

Regularly review and remediate alerts.

What is the primary purpose of the dependency graph?

To track and manage open source dependencies and their vulnerabilities.

Where do you enable code scanning in a repository?

In repository Settings > Security & analysis.

How does code scanning run on pull requests?

Automatically using a workflow file, checking for vulnerability patterns.

What should you do after a secret scanning alert?

Rotate the credential and remove the secret from history.

How does dependency review prevent supply chain attacks?

It blocks vulnerable dependencies from being merged by showing risks.

Can GitHub Advanced Security be used on private repositories?

Yes, but only on eligible plans like GitHub Enterprise.

Active recall deck

Practice GitHub Advanced Security with real flashcards

Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.

20 free cards

Card 1 of 20

1 reviewed this session

Connect the concepts

Your GitHub Advanced Security study mind map

Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.

GitHub Advanced Security15 questions in this practice set
Identify core security features of GitHub Advanced Security(1)
Understand automated security checks in pull requests(1)
Identify the purpose of secret scanning in code repositories(1)
Recognize tools for managing dependency security(1)
Determine prerequisites for enabling security features(1)
Link code review with security workflows(1)
Understand the mechanism behind code scanning(1)
Identify the tool for detecting exposed credentials(1)
Recognize the value of dependency vulnerability checks(1)
Understand the integration of security in development workflows(1)
Identify security alert management capabilities(1)
Explore customization options in code scanning(1)
More practice connections(3)
Exam-focused analysis

What this GitHub Advanced Security practice set measures

This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.

Core Features of GitHub Advanced Security

GitHub Advanced Security provides a suite of tools to enhance code security. Code scanning uses configurable analysis tools and queries to detect vulnerabilities in pull requests and code. Secret scanning identifies exposed credentials like API keys and passwords. Dependency review assesses open source components for known vulnerabilities. The dependency graph tracks dependencies and their security status. Together, these features automate security checks and reduce risk.

  • Code scanning analyzes code changes to find security flaws.
  • Secret scanning alerts on sensitive data committed to repositories.
  • Dependency review highlights vulnerable third-party libraries.
  • The dependency graph provides visibility into dependency relationships.

Integration into Development Workflow

GitHub Advanced Security embeds security early in the development lifecycle. Pull request reviews combined with automated scanning catch issues before merging. Code scanning runs on each pull request, checking for known vulnerability patterns. Secret scanning monitors commit history for credentials. This shift-left approach ensures security is a continuous part of coding rather than a final step. Teams can customize queries to address specific risks.

  • Automated checks run on pull requests to find vulnerabilities.
  • Secret scanning detects credentials in commits before they spread.
  • Custom queries allow tailoring of code scanning rules.
  • Early detection reduces cost and effort of fixing issues later.

Alert Management and Remediation

Properly managing alerts is crucial for maintaining security. GitHub Advanced Security provides a centralized dashboard for code scanning and secret scanning alerts. Teams must regularly review and prioritize these alerts based on severity and impact. Remediation involves fixing the code, rotating exposed secrets, and updating dependencies. Best practices include setting up notification preferences and integrating alerts into existing workflows. Ignoring alerts can lead to unaddressed vulnerabilities.

  • Alerts from code scanning and secret scanning are centralized.
  • Regular review and remediation are essential best practices.
  • Rotate exposed credentials immediately upon secret scanning alert.
  • Use severity levels to prioritize which alerts to address first.

Dependency Security and Supply Chain

Managing open source dependencies is a key aspect of supply chain security. The dependency graph visualizes all dependencies, while dependency review checks for known vulnerabilities in pull requests. This helps teams understand the risk posture of third-party components. Updating vulnerable libraries and removing unused dependencies are critical actions. GitHub Advanced Security facilitates this by providing actionable alerts and insights.

  • Dependency graph tracks all project dependencies.
  • Dependency review alerts on vulnerable components in pull requests.
  • Regularly update dependencies to mitigate known vulnerabilities.
  • Supply chain attacks can be prevented by monitoring dependency health.

Study workflow

Turn one GitHub Advanced Security attempt into a study plan

  1. 1

    Enable GitHub Advanced Security

    Ensure your repository is on an eligible GitHub plan (Enterprise or equivalent). Navigate to repository settings > Security & analysis > Enable code scanning and secret scanning. Verify the repository visibility meets requirements. This activates the core features.

  2. 2

    Configure Code Scanning

    Choose a code scanning tool (e.g., CodeQL). Add a workflow file to your repository or use the default configuration. Define queries, scheduling, and events (pull requests and pushes). Customize queries for specific vulnerability patterns as needed.

  3. 3

    Set Up Secret Scanning

    In repository settings, under Security & analysis, enable secret scanning. Optionally, configure custom patterns for your organization's secrets. Set up alerts to notify relevant teams. Regularly review and rotate any exposed credentials.

  4. 4

    Use Dependency Review

    Enable the dependency graph in Insights > Dependency graph. For pull requests, use the dependency review UI to preview vulnerabilities in changed dependencies. Require dependency review as a status check to block vulnerable dependencies from merging.

  5. 5

    Manage Alerts Effectively

    Regularly review alerts from the Security tab. Prioritize based on severity and relevance. Assign alerts to team members for remediation. Update code or dependencies to fix vulnerabilities. Rotate credentials for secret scanning alerts. Track progress and re-check after fixes.

FAQ

Questions about this exam practice page

Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.

What is the difference between code scanning and secret scanning in GitHub Advanced Security?+

Code scanning analyzes code for security vulnerabilities such as SQL injection or cross-site scripting. Secret scanning detects accidentally committed sensitive information like API keys, passwords, and tokens. Both aim to catch security issues early, but they address different risk types.

Can I customize the queries used in code scanning?+

Yes, GitHub Advanced Security allows custom queries for CodeQL analysis. Teams can write their own query files to detect patterns specific to their codebase or security policies. This flexibility helps address unique vulnerabilities not covered by default rules.

What should I do if secret scanning detects a credential in my repository?+

Immediately rotate the exposed credential (e.g., change the API key or password). Then remove the sensitive data from the repository history (e.g., using BFG Repo-Cleaner). Finally, investigate how the leak occurred to prevent future incidents.

How does dependency review help with supply chain security?+

Dependency review checks the security of open source packages in pull requests. It identifies known vulnerabilities in added or updated dependencies, providing a risk assessment. This prevents insecure components from being merged into the codebase.

Is GitHub Advanced Security available for all GitHub plans?+

No, GitHub Advanced Security features are available for repositories in GitHub Enterprise Cloud and GitHub Enterprise Server. Some features may also be available for public repositories on GitHub Free. Check your plan's eligibility in the repository settings.

Keep studying

Build the next review session

Browse another free bank or use the study strategy guide to turn your misses into spaced review.

All free testsStudy strategy