GH-500 · Domain 1: Describe GitHub Security suites, features, and ecosystem · 19% of the exam
Task 1.1: Understand GitHub Security suites and architecture
What GitHub Secret Protection and GitHub Code Security each contain, what public repositories get for free, where the features live in the Security and quality tab, and what security overview shows.
Study it
GitHub Secret Protection and GitHub Code Security: what each contains and what public repositories get free
Lesson coming
The Security and quality tab and security overview
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
An organization on GitHub Team keeps all of its code in private repositories. After a leaked cloud key, the security lead wants pushes that contain credentials blocked and the company's internal token format detected. There is no budget this year for static analysis of the code itself. Which purchase meets the goal at the lowest cost?
AGitHub Secret Protection for the repositories that need it
BGitHub Code Security for the repositories that need it
CAn upgrade from GitHub Team to GitHub Enterprise Cloud with no other product
DGitHub Secret Protection, plus an upgrade to GitHub Enterprise Cloud for custom patterns
Show the answer and why
AGitHub Secret Protection for the repositories that need it
Correct
Secret Protection contains push protection and custom patterns and is sold on its own, so the code analysis features don't have to be bought.
BGitHub Code Security for the repositories that need it
Incorrect
Code Security covers code scanning, premium Dependabot features and dependency review; push protection and custom patterns belong to Secret Protection.
CAn upgrade from GitHub Team to GitHub Enterprise Cloud with no other product
Incorrect
A plan upgrade on its own doesn't turn on secret scanning in private repositories; that still needs Secret Protection.
DGitHub Secret Protection, plus an upgrade to GitHub Enterprise Cloud for custom patterns
Incorrect
Custom patterns come with Secret Protection on GitHub Team as well, so the upgrade adds cost the goal doesn't need.
GitHub sells two Advanced Security products, each available on GitHub Team and GitHub Enterprise Cloud. GitHub Secret Protection holds secret scanning, push protection, custom patterns and delegated bypass; GitHub Code Security holds code scanning, Copilot Autofix, premium Dependabot features and dependency review. Each can be bought on its own, so an organization on GitHub Team that only needs secret controls buys Secret Protection.
On 1 March a developer moves to a team whose repositories don't have GitHub Code Security enabled, and never pushes again to the one repository that does. The organization pays for Code Security with metered billing and the developer is still an organization member. When does the developer stop being counted for Code Security?
AAt the end of the March billing cycle, when monthly usage is recalculated
BAbout 90 days after their last push to that repository
COn 1 March, as soon as the developer joins a team without access to that repository
DOnly after an owner removes the developer from the organization
Show the answer and why
AAt the end of the March billing cycle, when monthly usage is recalculated
Incorrect
The billing cycle doesn't reset the count; activity is judged over a rolling 90-day window.
BAbout 90 days after their last push to that repository
Correct
A committer is active only while one of their commits pushed to that repository falls within the last 90 days.
COn 1 March, as soon as the developer joins a team without access to that repository
Incorrect
Team membership doesn't decide the count; recent pushes to a repository with the product enabled do.
DOnly after an owner removes the developer from the organization
Incorrect
Removal is not required; inactivity alone ends the count once 90 days have passed.
Advanced Security usage is the number of unique, active committers to repositories with Secret Protection or Code Security enabled. A committer is active if one of their commits was pushed to such a repository within the last 90 days, whenever it was authored. After a developer stops pushing there, their contributions keep counting until 90 days have passed, and then they drop out of the billed count.
A startup on GitHub Team has only private repositories and hasn't bought GitHub Secret Protection or GitHub Code Security. Which two capabilities can it still use in those repositories? (Choose TWO.)
ACode scanning with CodeQL default setup
BDependabot alerts for vulnerable dependencies
CSecurity campaigns to burn down an alert backlog
DExporting the dependency graph as an SPDX SBOM
ESecret scanning alerts for leaked credentials
Show the answer and why
ACode scanning with CodeQL default setup
Incorrect
Code scanning in private repositories needs GitHub Code Security.
BDependabot alerts for vulnerable dependencies
Correct
Dependabot alerts come with every GitHub plan, with no Advanced Security product.
CSecurity campaigns to burn down an alert backlog
Incorrect
Security campaigns are part of Secret Protection and Code Security.
DExporting the dependency graph as an SPDX SBOM
Correct
SBOM export from the dependency graph is available on every plan.
ESecret scanning alerts for leaked credentials
Incorrect
Secret scanning in private repositories needs GitHub Secret Protection.
Some security features come with every GitHub plan: the dependency graph and its SBOM export, Dependabot alerts and security updates, Dependabot version updates, security policies and repository security advisories. Code scanning, secret scanning, security campaigns and security overview need Code Security or Secret Protection in private repositories.
An organization on GitHub Team wants to run the CodeQL CLI in its own CI system on private repositories and upload the results as code scanning alerts. What does it need?
AA GitHub Code Security license for those repositories
BNothing extra, because the CodeQL CLI is free for every repository
CGitHub Secret Protection for those repositories
DA move from GitHub Team to GitHub Enterprise Server
Show the answer and why
AA GitHub Code Security license for those repositories
Correct
The CodeQL CLI is free on public repositories; in private repositories it comes with GitHub Code Security.
BNothing extra, because the CodeQL CLI is free for every repository
Incorrect
The CLI is free to use on public repositories only.
CGitHub Secret Protection for those repositories
Incorrect
Secret Protection covers secret scanning and push protection, not CodeQL analysis.
DA move from GitHub Team to GitHub Enterprise Server
Incorrect
GitHub Team organizations can use the CLI on private repositories with Code Security; no server is needed.
The CodeQL CLI is free to use on public repositories. In private repositories owned by organizations on GitHub Team or GitHub Enterprise Cloud it is available with a GitHub Code Security license, and uploading SARIF results to show them as code scanning alerts is supported for organization-owned repositories with Code Security enabled.
Where does an organization owner open security overview for the organization?
AIn the Insights tab of each of the organization's repositories
BOn the organization's Security and quality tab
CIn the enterprise's Billing and licensing page
DIn the organization's Actions settings
Show the answer and why
AIn the Insights tab of each of the organization's repositories
Incorrect
Insights shows repository data such as the dependency graph.
BOn the organization's Security and quality tab
Correct
Security overview is found on the organization's Security and quality tab.
CIn the enterprise's Billing and licensing page
Incorrect
That page manages licenses, not security overview.
DIn the organization's Actions settings
Incorrect
Actions settings control workflows.
Security overview is on the Security and quality tab of any organization, and of the enterprise. Its views include Overview, Risk, Coverage, Assessments and Campaigns.
An open source maintainer has no paid GitHub plan. Which Advanced Security features can the maintainer use on a public repository free of charge?
AOnly Dependabot alerts
BNone at all
CSecurity campaigns and delegated bypass for push protection
DCode scanning, secret scanning and dependency review
Show the answer and why
AOnly Dependabot alerts
Incorrect
Public repositories get more than Dependabot alerts.
BNone at all
Incorrect
Public repositories get several features free.
CSecurity campaigns and delegated bypass for push protection
Incorrect
Neither is free on public repositories; each needs a paid Advanced Security product.
DCode scanning, secret scanning and dependency review
Correct
All public repositories have access to these free of charge.
All public repositories on GitHub.com have access to code scanning, secret scanning and dependency review free of charge. Private repositories need GitHub Code Security or GitHub Secret Protection for them.