Task 2.1: Enable and configure Secret Protection

• ASet both detections to Enabled in the security configuration applied to them

  Correct

  Organization-level enablement of these detections is done through a custom security configuration applied to the repositories.

• BTurn them on in the Advanced Security global settings under "Additional settings"

  Incorrect

  Global settings don't hold switches for these detections.

• CAsk an enterprise owner to set the enterprise's "AI detection in secret scanning" policy to Allowed

  Incorrect

  That policy decides whether repository admins may configure AI detection; it doesn't turn anything on.

• DAdd both detections to the push protection pattern configuration page

  Incorrect

  That page decides which patterns push protection blocks; it doesn't enable detection.

Both detections are enabled in a repository's Advanced Security settings or, for many repositories, through a custom security configuration with Secret Protection enabled and "Generic patterns" and "Scan for AI-detected secrets" set to Enabled, applied to the repositories. Global settings and enterprise policies control other things.

• AExtended metadata is collected for every alert, independently of validity checks

  Incorrect

  Extended metadata depends on validity checks being enabled.

• BExtended metadata can't be enabled while validity checks are disabled

  Correct

  You can enable extended metadata checks only if validity checks are enabled.

• CExtended metadata is collected only for secrets in public repositories

  Incorrect

  Repository visibility isn't the condition.

• DExtended metadata replaces validity checks, so the privacy review no longer applies

  Incorrect

  It adds information on top of validity checks; it doesn't replace them.

Extended metadata checks add context such as the owner of a detected secret, and they can only be enabled when validity checks are enabled, at repository level or in a security configuration. With validity checks enabled, GitHub may contact the issuing service to check whether a credential is active.

• AThey are limited to 5,000 alerts per repository, open and closed together

  Correct

  The generic list is capped at 5,000 alerts per repository.

• BThey are blocked by push protection by default

  Incorrect

  These detections raise alerts; they aren't part of push protection's default blocking.

• CThey don't appear in security overview's summary views, only in its Secret scanning view

  Correct

  Generic alerts are left out of the summary views.

• DThey are validated with the secret's provider automatically

  Incorrect

  Validity checks apply to supported provider patterns, not to generic finds.

• EThey show every location where the secret was detected

  Incorrect

  Only the first five locations are shown for generic patterns, and only the first for AI-detected secrets.

Alerts for generic patterns and AI-detected secrets can have more false positives. They are limited to 5,000 alerts per repository, are not shown in security overview's summary views, and only the first five detected locations are shown for generic patterns (the first one for AI-detected secrets).

• AIn the organization's billing and licensing page

  Incorrect

  Billing manages licenses, not repository settings.

• BIn the repository's Insights tab

  Incorrect

  Insights shows graphs such as the dependency graph.

• CIn the repository's Settings, under Advanced Security

  Correct

  The Secret Protection Enable control is on the Advanced Security settings page.

• DIn the .github/dependabot.yml file

  Incorrect

  That file is for Dependabot, not Secret Protection.

In a repository's Settings, in the Security and quality section of the sidebar, click Advanced Security, then click Enable to the right of Secret Protection and confirm.

• AThe full Git history of every branch in the repository

  Correct

  Secret scanning scans the entire Git history on all branches.

• BOnly commits pushed after Secret Protection was enabled

  Incorrect

  Secret scanning also covers what was committed before.

• COnly the most recent commit on the default branch

  Incorrect

  It isn't limited to one branch or one commit.

• DOnly the files that open pull requests change

  Incorrect

  It isn't limited to pull requests.

Secret scanning scans the entire Git history on all branches of a repository for hardcoded credentials such as API keys, passwords and tokens, and GitHub periodically rescans repositories when new secret types are added.

• ANothing; generic secrets are always scanned for

  Incorrect

  Generic patterns must be enabled first.

• BA custom pattern must be written for each key type

  Incorrect

  Generic patterns are built in.

• CPush protection must be turned off

  Incorrect

  Push protection is unrelated.

• DScanning for generic patterns must be enabled

  Correct

  Generic patterns are an optional detection.

Generic patterns correspond to secrets such as private keys. Scanning for them is an optional detection that must be enabled, for example in a repository's Secret Protection settings.

• AYes, in the repository's Advanced Security settings

  Incorrect

  The partner configuration on public repositories can't be changed.

• BNo; it can't be changed on public repositories

  Correct

  GitHub scans public repositories for partner secrets regardless.

• CYes, by disabling push protection for users

  Incorrect

  That is a personal account setting for pushes.

• DYes, by adding a secret_scanning.yml file

  Incorrect

  No repository file changes partner scanning on public repositories.

GitHub scans public repositories and public npm packages for secrets issued by partner providers. You cannot change the configuration of secret scanning for partner patterns on public repositories.