Pass the GitHub Certification GitHub-Advanced-Security Questions and answers with ExamsMirror

The correct place to look is the SECURITY.md file. This file provides contributors and security researchers with instructions on how to responsibly report vulnerabilities. It may include contact methods, preferred communication channels (e.g., security team email), and disclosure guidelines.

This file is considered a GitHub best practice and, when present, activates a “Report a vulnerability” button in the repository’sSecuritytab.

To proactively address secret scanning:

Webhookscan be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.

Documenting secure development practices(like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.

Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.

If an alert is raised on apull request dependency, best practice is toupdate the dependencyto a secure versionbeforemerging the PR. This prevents the vulnerable version from entering the main codebase.

Merging or deploying the PR without fixing the issue exposes your production environment to known risks.

Ifautobuildfails (which attempts to automatically detect how to build your project), you shoulddisable itin your workflow andreplace it with explicit build commands, using steps like run: make or run: ./gradlew build.

This ensures CodeQL can still extract and analyze the code correctly.

You shoulddismissa code scanning alert if the flagged code isnot a true security concern, such as:

Code in test files

Code paths that are unreachable or safe by design

False positives from the scanner

Fixing the code would automaticallyresolvethe alert — not dismiss it. Dismissing is for valid exceptions or noise reduction.

Comprehensive and Detailed Explanation:

When setting up CodeQL analysis for compiled languages, there are two primary methods to buildyour code:​

GitHub Docs

Autobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.​

GitHub Docs

Custom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.​

GitHub Docs

The init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.​

Validity checks, also calledsecret validation, allow GitHub to check if a detected secret isstill active. If verified as live, the alert is marked as"valid", allowing security teams to prioritize the most critical leaks.

Push protectionblockssecrets but does not check their validity. Custom patterns are user-defined and do not include live checks.

Requesting a CVE ID for a security advisory in a GitHub repository requiresAdminpermissions. This level of access is necessary because it involves managing sensitive security information and coordinating with external entities to assign a CVE, which is a formal process that can impact the public perception and security posture of the project.​

Comprehensive and Detailed Explanation:

Before defining a custom pattern for secret scanning in a repository, you must enable secretscanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.​

Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.​

To exclude specific files or directories from being scanned by secret scanning in GitHub Actions, you can use thepaths-ignore:key within your YAML workflow file.

This tells GitHub toignore specified pathswhen scanning for secrets, which can be useful for excluding test data or non-sensitive mock content.

Other options listed are invalid:

branches-ignore: excludes branches, not files.

decrypt_secret.sh is not a YAML key.

secret scanning.yml is not a recognized filename for configuration.