Task 2.4: Control access, policies, and customization

• ARun against exactly the 25 selected repositories, and create draft alerts for review

  Incorrect

  Selected repositories are limited to 10, and a dry run creates no alerts.

• BRun only in the engineer's own fork of each repository

  Incorrect

  Dry runs run against the organization's repositories.

• CRun on all of the organization's repositories, or on up to 10 selected ones

  Correct

  Those are the two scopes for an organization-level dry run.

• DRun only after push protection is enabled for the pattern

  Incorrect

  The order is the reverse: dry run and publish first, then enable push protection.

At organization level, Save and dry run lets you choose All repositories in the organization or up to 10 selected repositories. The dry run finds matches without creating alerts and shows a sample of up to 1,000 results to review for false positives. Push protection for the pattern can be enabled only after it is published.

• APut the whole expression in the secret format, and add Hyperscan's case-insensitive option modifier

  Incorrect

  Hyperscan option modifiers aren't supported in custom patterns.

• BKeep the default expressions around acme_key= and raise the minimum length to 40

  Incorrect

  The token is 32 characters, so a longer minimum would miss every real one.

• CCreate a second pattern for the all-zero value and delete its alerts by hand

  Incorrect

  The exclusion belongs in additional match requirements, not in a separate pattern.

• DHex format as secret format, acme_key= before it, and a must-not-match rule for zeros

  Correct

  The fields let you anchor the secret and exclude values without one complex expression.

A custom pattern has a secret format, an optional Before secret expression (by default a start of line or non-alphanumeric character), an After secret expression, and additional match requirements that the secret must or must not match. Option modifiers aren't supported.

• A.github/dependabot.yml

  Incorrect

  That configures Dependabot.

• B.github/codeql/codeql-config.yml

  Incorrect

  That configures CodeQL.

• C.github/secret_scanning.yml

  Correct

  A paths-ignore list in this file excludes directories.

• DSECURITY.md

  Incorrect

  That is a security policy.

A .github/secret_scanning.yml file with a paths-ignore list automatically closes alerts for secrets found in the listed paths and excludes them from push protection.

• AA visible team

  Incorrect

  Visible teams can be added.

• BA team with the security manager role

  Incorrect

  Such teams can be added.

• CA nested child team

  Incorrect

  Nesting isn't the restriction.

• DA secret team

  Correct

  You can't add secret teams to the bypass list.

When configuring delegated bypass, you add roles and teams to the bypass list; secret teams can't be added.

• AA plain-language description and an example string

  Correct

  You describe what the expression should capture, ideally in English, and give an example of what you're looking for.

• BAn existing regular expression for it to optimize

  Incorrect

  You can type an expression yourself instead, but the generator starts from a description.

• CRead access to past secret scanning alerts to learn from

  Incorrect

  It generates expressions from your input, not from alert history.

• DA completed dry run of the pattern on the repository

  Incorrect

  A dry run comes after a pattern is drafted, to test it.

The generator uses an AI model to suggest regular expressions that match your input: you describe, ideally in plain English, what the pattern should capture and add an example of what you're looking for. You then pick a suggestion, test it with a dry run and publish the pattern.

• ATo stop alerts for a provider's tokens

  Incorrect

  Custom patterns add detections; they don't silence provider patterns.

• BTo detect an internal secret format

  Correct

  Custom patterns find organization-specific secrets.

• CTo scan a repository's dependencies for known vulnerabilities

  Incorrect

  That is Dependabot's job.

• DTo choose which branches secret scanning reads

  Incorrect

  Secret scanning reads all branches; patterns don't select branches.

You can define custom patterns to identify secrets that the default patterns supported by secret scanning don't detect, for example a token format that is internal to your organization.