GH-500 · Domain 3: Configure and use supply chain security (formerly Dependabot/Dependency Review) · 18% of the exam
Task 3.2: Detect, prioritize, and respond to supply chain alerts
Dependabot alerts and security updates, ranking alerts by severity, EPSS, scope and patch availability, and auto-triage rules that dismiss or route them.
Study it
Dependabot alerts, security updates, EPSS and auto-triage rules
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A repository with GitHub Code Security receives too many Dependabot security update pull requests. The team wants Dependabot to open pull requests only for critical alerts in runtime dependencies and to keep every alert visible. What should the repository administrator configure?
AKeep security updates enabled and add a rule that dismisses all other alerts
BKeep security updates enabled, and set open-pull-requests-limit to 1 in the repository's dependabot.yml
CDisable security updates, and add a rule that opens pull requests for those alerts
DEnable grouped security updates so that all fixes arrive in one pull request
Show the answer and why
AKeep security updates enabled and add a rule that dismisses all other alerts
Incorrect
Dismissing hides the other alerts, which the team wants to keep visible.
BKeep security updates enabled, and set open-pull-requests-limit to 1 in the repository's dependabot.yml
Incorrect
A limit throttles the number of pull requests; it doesn't choose which alerts get them.
CDisable security updates, and add a rule that opens pull requests for those alerts
Correct
An "open a pull request" rule takes effect only when security updates are disabled.
DEnable grouped security updates so that all fixes arrive in one pull request
Incorrect
Grouping merges pull requests; it doesn't restrict them to critical runtime alerts.
With Dependabot security updates enabled, Dependabot tries to open pull requests for every open alert that has a patch. To choose which alerts get pull requests, leave security updates disabled and create a custom auto-triage rule with "Open a pull request to resolve this alert", targeted by metadata such as severity and dependency scope.
A private npm repository has hundreds of low-impact alerts on development dependencies, such as slow-build issues in test tooling, while the same alerts in the company's public repositories were dismissed automatically. Why the difference?
AThe preset rule runs only in repositories with GitHub Code Security
BThe preset rule dismisses alerts only for dependencies in production scope
CPublic repositories send their alerts to npm, which dismisses them
DThe development-scoped preset is on by default only for public repositories
Show the answer and why
AThe preset rule runs only in repositories with GitHub Code Security
Incorrect
GitHub presets are available for all repositories.
BThe preset rule dismisses alerts only for dependencies in production scope
Incorrect
It targets development-scoped dependencies.
CPublic repositories send their alerts to npm, which dismisses them
Incorrect
Dismissal comes from the preset rule, not from npm.
DThe development-scoped preset is on by default only for public repositories
Correct
Private repositories have to opt in to the rule.
"Dismiss low impact issues for development-scoped dependencies" is a GitHub preset that auto-dismisses certain low-impact vulnerabilities in npm development dependencies. It is enabled by default for public repositories and can be opted into for private repositories in the repository's Dependabot rules settings.
A repository has the dependency graph enabled. Which other feature must be turned on before Dependabot security updates can open pull requests there?
ADependabot version updates with a dependabot.yml file
BDependabot alerts for the repository
CCodeQL default setup for the repository
DGitHub Secret Protection
Show the answer and why
ADependabot version updates with a dependabot.yml file
Incorrect
Security updates don't need version updates to be configured.
BDependabot alerts for the repository
Correct
Security updates are available where the dependency graph and Dependabot alerts are enabled.
CCodeQL default setup for the repository
Incorrect
Code scanning isn't a prerequisite for dependency updates.
DGitHub Secret Protection
Incorrect
Secret Protection covers secrets, not dependency updates.
The Dependabot security updates feature is available for repositories where the dependency graph and Dependabot alerts are enabled. Dependabot then tries to open pull requests for open alerts that have an available patch, for dependencies specified in a manifest or lock file.
What does an EPSS score on a Dependabot alert express?
AThe likelihood of exploitation in the next 30 days
BHow severe the vulnerability is if exploited
CHow many public repositories use the vulnerable package
DHow long the vulnerability has been public
Show the answer and why
AThe likelihood of exploitation in the next 30 days
Correct
EPSS is an exploit probability.
BHow severe the vulnerability is if exploited
Incorrect
That is CVSS severity.
CHow many public repositories use the vulnerable package
Incorrect
That isn't EPSS.
DHow long the vulnerability has been public
Incorrect
That isn't EPSS.
The Exploit Prediction Scoring System, from FIRST, gives a score (0 to 100%) for the probability that a vulnerability will be exploited in the next 30 days, and a percentile. GitHub updates it daily.
How can a team find alerts that auto-triage rules dismissed?
AThey are deleted, so they can't be found
BFilter by severity:low
CSearch the dependency graph
DFilter for the auto-dismiss resolution
Show the answer and why
AThey are deleted, so they can't be found
Incorrect
Auto-dismissed alerts are kept.
BFilter by severity:low
Incorrect
Severity isn't how dismissals are recorded.
CSearch the dependency graph
Incorrect
Alerts aren't listed there.
DFilter for the auto-dismiss resolution
Correct
Auto-dismissed alerts have the resolution:auto-dismiss close reason.
Auto-dismissed alerts are defined by the resolution:auto-dismiss close reason, so you can filter for them and report on them. Auto-dismissal activity also appears in webhooks, the APIs and the audit log.
When does Dependabot scan a repository's default branch and raise new alerts?
AOnly once a month
BOnly when a developer asks for a scan of the repository
CWhen a new advisory appears or the graph changes
DOnly when a pull request is opened
Show the answer and why
AOnly once a month
Incorrect
Alerts aren't monthly.
BOnly when a developer asks for a scan of the repository
Incorrect
Scans are triggered automatically.
CWhen a new advisory appears or the graph changes
Correct
These two events trigger alerts.
DOnly when a pull request is opened
Incorrect
Alerts are about the default branch.
Dependabot scans the repository's default branch and sends alerts when a new vulnerability is added to the GitHub Advisory Database or when the dependency graph changes, for example after a push that updates packages.