GH-500 · Domain 2: Configure and use Secret Protection (formerly secret scanning) · 19% of the exam
Task 2.2: Prevent secret exposure
Push protection on the command line, in the web UI and through the API, push protection for users, and validity checks that rank leaked credentials by risk.
Study it
Secret leakage risks and keeping credentials out of code
Push protection, bypass reasons and validity checks
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
Push protection blocks a developer's push from the command line because of a test credential. She sends the bypass URL from the error message to her team lead, who opens it to approve the push on her behalf, and gets a 404 error. What should happen instead?
AThe team lead should open the URL in a private browser window
BThe developer should forward the URL to an organization owner instead
CThe developer should open the URL herself and push within three hours
DThe developer should push again with the --no-verify flag so that Git skips the server-side check
Show the answer and why
AThe team lead should open the URL in a private browser window
Incorrect
The URL works only for the user who performed the push.
BThe developer should forward the URL to an organization owner instead
Incorrect
Any user other than the one who pushed gets a 404, owners included.
CThe developer should open the URL herself and push within three hours
Correct
The bypass URL must be visited by the same user, and the push retried within three hours.
DThe developer should push again with the --no-verify flag so that Git skips the server-side check
Incorrect
Push protection runs on GitHub's side; a local Git flag doesn't skip it.
To bypass a block from the command line, the user who performed the push visits the URL returned by GitHub, chooses a reason such as "It's used in tests", and clicks Allow me to push this secret. A different user who opens the URL gets a 404. The push must be retried within three hours, or the process has to be repeated.
A deployment script updates a configuration file through the REST API's "Create or update file contents" endpoint. After push protection was enabled, the call fails with HTTP 409 because the file contains a sample key used in tests. The script has no browser. What are its options?
ARetry the same request, because 409 means a temporary conflict
BPush the file with Git over HTTPS instead, which push protection doesn't check
CAsk an owner to disable push protection for users on the script's account
DRemove the secret from the content, or call "Create a push protection bypass" first
Show the answer and why
ARetry the same request, because 409 means a temporary conflict
Incorrect
The 409 means a secret was detected; retrying the same content fails again.
BPush the file with Git over HTTPS instead, which push protection doesn't check
Incorrect
Push protection checks pushes from the command line too, so the push is blocked the same way.
CAsk an owner to disable push protection for users on the script's account
Incorrect
Push protection for users isn't what blocked a repository with push protection enabled.
DRemove the secret from the content, or call "Create a push protection bypass" first
Correct
Those are the two documented ways to resolve the 409.
The REST API's "Create a blob" and "Create or update file contents" endpoints include push protection. If the content includes a supported secret, the API returns a 409 error. The caller can remove the secret and retry, or bypass push protection with the "Create a push protection bypass" endpoint.
AIt blocks every push you make to private repositories in any organization
BIt blocks your pushes of secrets to public repositories
CIt scans your personal account's history for secrets
DIt creates an alert each time you bypass it
Show the answer and why
AIt blocks every push you make to private repositories in any organization
Incorrect
It covers public repositories.
BIt blocks your pushes of secrets to public repositories
Correct
It is on by default and applies to public repositories.
CIt scans your personal account's history for secrets
Incorrect
It acts at push time.
DIt creates an alert each time you bypass it
Incorrect
Bypassing only push protection for users creates no alert.
Push protection for users is on by default for your account. It stops you pushing supported secrets to public repositories, whether or not the repository has secret scanning enabled, and doesn't create alerts when you bypass it unless the repository also has push protection.
There are two types of push protection. Push protection for repositories requires GitHub Secret Protection, is disabled by default and can be enabled at repository, organization or enterprise level. Push protection for users is specific to your account and enabled by default.
A push contains eight new supported secrets. How many does the command-line message show at once?
AUp to five
BThree
COne
DAll eight
Show the answer and why
AUp to five
Correct
Up to five detected secrets are displayed at a time on the command line.
BThree
Incorrect
The command line shows up to five.
COne
Incorrect
The web UI shows one at a time; the command line shows more.
DAll eight
Incorrect
The message is capped at five.
When push protection blocks a push from the command line, up to five detected secrets are displayed at a time. In the web UI, GitHub displays one detected secret at a time.
Which validity statuses can a secret scanning alert show?
AValid, expired or revoked
BOpen, closed or dismissed
CActive, inactive or unknown
DCritical, high or low
Show the answer and why
AValid, expired or revoked
Incorrect
These aren't the status names.
BOpen, closed or dismissed
Incorrect
These are alert states, not validity statuses.
CActive, inactive or unknown
Correct
GitHub shows active, inactive or unknown.
DCritical, high or low
Incorrect
These are severities.
GitHub displays the validation status of a secret in the alert view: active, inactive or unknown. For most secrets you can also run an on-demand check.