GH-500 · Domain 5: Security operations: best practices, prioritization, and remediation · 18% of the exam
Task 5.4: Collaborate across roles and enforce governance
Security managers, delegated exceptions and alert owners, working campaigns with development teams, and rules that span the security products.
Study it
Roles, delegated exceptions, alert ownership and cross-suite governance
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
An audit at an organization found two problems: developers bypassed push protection for real tokens by choosing "It's used in tests", and developers closed secret scanning alerts as false positives without any review. The security team, which holds the security manager role, must approve both kinds of exception before they take effect, and developers keep write access. What should an owner configure?
ADelegated bypass for push protection only, because bypass reviewers also approve alert closures
BDelegated alert dismissal for secret scanning only, because dismissal requests also cover push protection bypasses
CRemove the developers' write access, so they can neither push nor close alerts
DDelegated bypass with the security team as reviewers, plus delegated alert dismissal for secret scanning
Show the answer and why
ADelegated bypass for push protection only, because bypass reviewers also approve alert closures
Incorrect
Delegated bypass governs pushes that contain secrets; closing an alert is a separate action.
BDelegated alert dismissal for secret scanning only, because dismissal requests also cover push protection bypasses
Incorrect
Closing an alert and pushing past a block are separate exceptions, each with its own control.
CRemove the developers' write access, so they can neither push nor close alerts
Incorrect
That breaks the requirement that developers keep write access.
DDelegated bypass with the security team as reviewers, plus delegated alert dismissal for secret scanning
Correct
Each feature governs one kind of exception, so the organization needs both.
Delegated bypass for push protection makes contributors without bypass privileges submit a bypass request that designated reviewers approve or deny. Delegated alert dismissal puts a review in front of closing secret scanning alerts. The two features cover different exceptions, so the organization needs both.
The AppSec team holds the security manager role. A repository administrator who wants fewer people in a sensitive repository tries to remove the AppSec team from it. What can the administrator do?
ARemove the team in the repository's access settings
BChange the team's access level, but not remove the team's access
CNothing: the team's access can't be changed at all
DRemove the role from the team in the repository settings
Show the answer and why
ARemove the team in the repository's access settings
Incorrect
Access granted through the security manager role can't be removed this way.
BChange the team's access level, but not remove the team's access
Correct
Admins can change the level but can't remove it.
CNothing: the team's access can't be changed at all
Incorrect
The level can be changed.
DRemove the role from the team in the repository settings
Incorrect
Organization owners assign or remove organization roles.
If a team has the security manager role, people with admin access to the team and to a specific repository can change the team's level of access to that repository but can't remove the access. The security manager role itself is assigned by organization owners.
To whom can an organization owner assign the security manager role?
AOnly to outside collaborators
BOnly to individual members
CTo an organization team or directly to a member
DOnly to enterprise owners
Show the answer and why
AOnly to outside collaborators
Incorrect
The role is for organization members and teams.
BOnly to individual members
Incorrect
Teams can hold the role.
CTo an organization team or directly to a member
Correct
Both are possible.
DOnly to enterprise owners
Incorrect
Organization members and teams can hold it.
You can assign the predefined security manager role to an organization team or directly to an organization member. Larger organizations may create a dedicated security team.
How can a campaign point developers to the place to ask the security team questions?
ABy adding a SECURITY.md file
BBy editing the dependabot.yml file
CBy creating a custom pattern
DBy adding a contact link to the campaign
Show the answer and why
ABy adding a SECURITY.md file
Incorrect
That is a reporting policy.
BBy editing the dependabot.yml file
Incorrect
That file is for Dependabot.
CBy creating a custom pattern
Incorrect
Patterns are for secret scanning.
DBy adding a contact link to the campaign
Correct
Campaigns can include a contact link.
When creating a campaign you can provide a contact link, for example to a GitHub Discussions thread or another channel, for contacting the campaign managers.
A developer who maintains a repository hears that a new security campaign includes some of its alerts. Where does the developer find the campaign's alerts for that repository?
AOnly in security overview, once a security manager grants access
BUnder Campaigns on the repository's Security and quality tab
CIn the repository's Actions tab, as a failing workflow run
DIn the Dependabot alerts list, filtered by the campaign's name
Show the answer and why
AOnly in security overview, once a security manager grants access
Incorrect
Developers reach the campaign from the repository itself.
BUnder Campaigns on the repository's Security and quality tab
Correct
The repository's Security and quality tab lists the campaign under Campaigns in the sidebar.
CIn the repository's Actions tab, as a failing workflow run
Incorrect
A campaign isn't a workflow run.
DIn the Dependabot alerts list, filtered by the campaign's name
Incorrect
Campaigns have their own view; they aren't a Dependabot filter.
When a campaign targets alerts in a repository you work on, open the repository's Security and quality tab and click the campaign under Campaigns in the sidebar. When the fixes are ready, open a pull request and ask the campaign manager for a review.
With delegated alert dismissal enabled, how are reviewers told about a new dismissal request?
ABy email, and the requester later hears the outcome
BThrough a pull request comment
COnly by checking the audit log
DThrough a new issue that GitHub opens in the repository
Show the answer and why
ABy email, and the requester later hears the outcome
Correct
Both are notified by email.
BThrough a pull request comment
Incorrect
Requests aren't pull request comments.
COnly by checking the audit log
Incorrect
They are notified directly.
DThrough a new issue that GitHub opens in the repository
Incorrect
No issue is created.
With delegated alert dismissal, reviewers are notified of dismissal requests by email and approve or deny them; after review, the requester is notified of the outcome by email.