GH-500 · Domain 5: Security operations: best practices, prioritization, and remediation · 18% of the exam
Task 5.2: Prioritize and manage security work at scale
Severity-driven rules and rulesets, security campaigns and bulk alert work, and recording why alerts were closed automatically.
Study it
Severity rules, rulesets, campaigns and bulk alert work
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A security manager tries to start a new campaign for 600 deserialization alerts, but the organization already has 10 active campaigns, three of which have reached their goals. What should she do?
AClose the three finished campaigns, then create the new one
BAsk GitHub Support to raise the active campaign limit
CSplit the 600 alerts across the existing campaigns by editing their filters
DCreate the campaign as a draft, which doesn't count toward any limit and can collect alerts
Show the answer and why
AClose the three finished campaigns, then create the new one
Correct
Closing campaigns frees active slots, and closed campaigns can be reopened later.
BAsk GitHub Support to raise the active campaign limit
Incorrect
The limit of 10 active campaigns isn't raised on request.
CSplit the 600 alerts across the existing campaigns by editing their filters
Incorrect
Changing other campaigns' scope muddles their goals and tracking.
DCreate the campaign as a draft, which doesn't count toward any limit and can collect alerts
Incorrect
Drafts are for preparing a campaign, not for running one past the limit.
There is a limit of 10 active campaigns. When a campaign is complete, or to pause it, close it; closed campaigns stay in the Closed list and can be reopened. Each campaign can include up to 1,000 alerts, so 600 alerts fit in one.
A security manager drafts a campaign and wants the payments team's engineering lead, a regular member with write access, as the campaign manager who answers developers' questions. The lead can't be selected. What is the right fix?
AMake the lead a security manager, or name the lead in the contact link
BGive the lead write access to more repositories in the campaign
CPublish the campaign first, because managers can be chosen only after publishing
DAdd the lead as an assignee on every alert in the campaign, which makes the lead a manager automatically
Show the answer and why
AMake the lead a security manager, or name the lead in the contact link
Correct
Campaign managers must be organization owners or security managers.
BGive the lead write access to more repositories in the campaign
Incorrect
Repository access doesn't make someone eligible as a manager.
CPublish the campaign first, because managers can be chosen only after publishing
Incorrect
Managers are set while drafting or creating the campaign.
DAdd the lead as an assignee on every alert in the campaign, which makes the lead a manager automatically
Incorrect
Assignment and campaign management are separate.
When creating a campaign you set a due date and one or more campaign managers as primary contacts. Campaign managers must be users or teams that are owners or security managers in the organization. A contact link, for example to a discussion, can point developers to another channel.
How can an analyst take security overview data into an external tool?
ACopy the data from the audit log only
BDownload CSV files from security overview pages
CExport an SBOM
DUse secret_scanning.yml
Show the answer and why
ACopy the data from the audit log only
Incorrect
Security overview has its own export.
BDownload CSV files from security overview pages
Correct
Several pages can be exported as CSV.
CExport an SBOM
Incorrect
SBOMs list dependencies.
DUse secret_scanning.yml
Incorrect
That file configures secret scanning; it doesn't export data.
You can download CSV files with data from several pages of an organization's or enterprise's security overview, for security research and in-depth analysis with external datasets.
Which detail does a security manager set for a campaign to track progress toward a target?
AA query suite
BA dependabot.yml schedule
CA campaign due date
DA runner label
Show the answer and why
AA query suite
Incorrect
Suites are set in code scanning configuration.
BA dependabot.yml schedule
Incorrect
That schedules Dependabot updates.
CA campaign due date
Correct
Campaigns have a due date.
DA runner label
Incorrect
Runners are unrelated.
When finalizing a campaign you set a campaign due date and one or more campaign managers. The tracking view shows whether campaigns are on track to meet their due dates.
Why should a developer add a comment when dismissing a Dependabot alert?
AIt closes the alert faster
BIt notifies npm
CIt hides the alert from security overview and from the alert list
DIt records the justification on the alert timeline
Show the answer and why
AIt closes the alert faster
Incorrect
It doesn't change speed.
BIt notifies npm
Incorrect
Comments aren't sent to registries.
CIt hides the alert from security overview and from the alert list
Incorrect
Comments don't hide alerts.
DIt records the justification on the alert timeline
Correct
The comment documents the decision.
When you dismiss an alert you can add a comment. The dismissal comment is added to the alert timeline and can be used as justification during auditing and reporting.