Join the discussion
Question 8/78
Which of the following options would close a Dependabot alert?
Correct Answer: A
A Dependabot alert is only marked as resolved when the related vulnerability is no longer present in your code - specifically after you merge a pull request that updates the vulnerable dependency.
Simply viewing alerts or graphs does not affect their status. Ignoring the alert by leaving the repo unchanged keeps the vulnerability active and unresolved.
Simply viewing alerts or graphs does not affect their status. Ignoring the alert by leaving the repo unchanged keeps the vulnerability active and unresolved.
Add Comments
- Other Question (78q)
- Q1. Which of the following options would close a Dependabot alert?...
- Q2. Which of the following information can be found in a repository's Security tab?...
- Q3. What step is required to run a SARIF-compatible (Static Analysis Results Interchange Forma...
- Q4. By default, what is the minimum role needed to bypass push protection in a repository?...
- Q5. Which of the following Watch settings could you use to get Dependabot alert notifications?...
- Q6. What are Dependabot security updates?
- Q7. Which of the following benefits do code scanning, secret scanning, and dependency review p...
- Q8. Which of the following options would close a Dependabot alert?...
- Q9. Which syntax in a query suite tells CodeQL to look for one or more specified .ql files?...
- Q10. What does code scanning do?
- Q11. Which syntax in a query suite tells CodeQL to look for one or more specified .ql files?...
- Q12. How many alerts are created when two instances of the same secret value are in the same re...
- Q13. How does secret scanning availability differ for public and private repositories on GitHub...
- Q14. What were the long-term impacts of the Cultural Revolution on Chinese society?...
- Q15. To be compatible with code scanning, what data format must third-party code scanning tools...
- Q16. After defining a secret scanning custom pattern, what is the final step before publishing ...
- Q17. If notification and alert recipients are not customized, which users receive notifications...
- Q18. Which CodeQL query suite provides queries of lower severity than the default query suite?...
- Q19. Where can you view code scanning results from CodeQL analysis?...
- Q20. The autobuild step in the CodeQL workflow has failed. What should you do?...
- Q21. As a developer with write access, you navigate to a code scanning alert in your repository...
- Q22. A dependency has a known vulnerability. What does the warning message include?...
- Q23. What is a prerequisite to define a custom pattern for a repository?...
- Q24. By default, which roles can enable Dependabot alerts?...
- Q25. Where can you use CodeQL analysis for code scanning? Each answer presents part of the solu...
- Q26. You have a GitHub Enterprise Cloud Organization that contains a private repository named R...
- Q27. Which of the following is required to block the merge of a pull request containing critica...
- Q28. Which of the following Watch settings could you use to get Dependabot alert notifications?...
- Q29. Assuming that notification and alert recipients are not customized, what does GitHub do wh...
- Q30. Which Dependabot configuration fields are required? Each answer presents part of the solut...
- Q31. What is a security policy?
- Q32. Where can you find a deleted line of code that contained a secret value?...
- Q33. Which GitHub security feature should you use to see details of any vulnerable dependency v...
- Q34. How many alerts are created when two instances of the same secret value are in the same re...
- Q35. You have a GitHub organization on GitHub Team that has GitHub Secret Protection enabled. T...
- Q36. Drag and Drop Question You have a GitHub Enterprise Server instance named Server1 that con...
- Q37. Which of the following tasks can be performed by a security team as a proactive measure to...
- Q38. What scenario demonstrates the use of Dependabot security updates?...
- Q39. Which of the following steps should you follow to integrate CodeQL into a third-party cont...
- Q40. Which of the following is the best way to prevent developers from adding secrets to the re...
- Q41. When using CodeQL, how does extraction for compiled languages work?...
- Q42. You have a GitHub repository named Repo1that runs CodeQL code scanning. Repo1contains both...
- Q43. In a private repository, what minimum requirements does GitHub need to generate a dependen...
- Q44. What classification is used to categorize Dependabot alerts? Each correct answer presents ...
- Q45. When configuring code scanning with CodeQL, what are your options for specifying additiona...
- Q46. You have a GitHub Enterprise Cloud Organization that uses GitHub Advanced Security code sc...
- Q47. When secret scanning detects a set of credentials on a public repository, what does GitHub...
- Q48. Assuming security and analysis features are not configured at the repository, organization...
- Q49. Hotspot Question You have a GitHub Enterprise Cloud Organization that uses GitHub Advanced...
- Q50. Which of the following dependencies could trigger a Dependabot alert? Each answer presents...
- Q51. How would you build your code within the CodeQL analysis workflow? (Each answer presents a...
- Q52. Assuming that notification and alert recipients are not customized, what does GitHub do wh...
- Q53. Which of the following statements best describes secret scanning push protection?...
- Q54. Which of the following workflow events would trigger a dependency review? (Each answer pre...
- Q55. What is the difference between scheduled versus triggered events in code scanning?...
- Q56. What step is required to run a SARIF-compatible (Static Analysis Results Interchange Forma...
- Q57. What is code scanning?
- Q58. As a repository owner, you want to receive specific notifications, including security aler...
- Q59. By default, who will receive an e-mail when a secret has been detected in a repository? Ea...
- Q60. What do you need to do before you can define a custom pattern for a repository?...
- Q61. Assuming there is no custom Dependabot behavior configured, where possible, what does Depe...
- Q62. What filter or sort settings can be used to prioritize the secret scanning alerts that pre...
- Q63. Which of the following statements best describes secret scanning push protection?...
- Q64. Which key is required in the update settings of the Dependabot configuration file?...
- Q65. Assuming that no custom Dependabot behavior is configured, who has the ability to merge a ...
- Q66. What does a CodeQL database of your repository contain?...
- Q67. You have a GitHub Enterprise Cloud Organization that contains public repositories and uses...
- Q68. You have enabled security updates for a repository. When does GitHub mark a Dependabot ale...
- Q69. What is the best way to ensure that added dependencies' licenses are checked and new code ...
- Q70. What is the exportable SBOM format created by the dependency graph on GitHub?...
- Q71. You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where...
- Q72. If default code security settings have not been changed at the repository, organization, o...
- Q73. Which of the following is the best way to dispose of a compromised secret?...
- Q74. What combination of security measures helps to mitigate risks throughout the SDLC (Softwar...
- Q75. Who can fix a code scanning alert on a private repository?...
- Q76. You are managing code scanning alerts for your repository. You receive an alert highlighti...
- Q77. Assuming that no custom patterns are configured, what type of secret is detected by secret...
- Q78. Which of the following features helps to prioritize secret scanning alerts that present an...
