GH-500 · Domain 6: GitHub Security suites administration · 13% of the exam
Task 6.3: Define governance, access, and Code Security workflows
Enterprise and organization policies, rulesets and their bypass lists, and the administrator, security manager and developer roles for managing and dismissing alerts.
Study it
Enterprise policies, rulesets, bypass permissions and roles for alerts
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
The enterprise allows AI Scan, but the organization hasn't turned it on because of AI credit budgets. A repository administrator wants AI Scan on pull requests for one organization-owned private PHP service, which has GitHub Code Security and code scanning enabled. What has to happen?
AShe turns on the AI Scan for pull requests toggle in the repository's code scanning settings
BShe switches the repository to CodeQL default setup, which turns AI Scan on
CHer developers get GitHub Copilot licenses, which makes the AI Scan setting appear
DAn organization owner or security manager turns AI Scan on for the organization; other repositories can then opt out
Show the answer and why
AShe turns on the AI Scan for pull requests toggle in the repository's code scanning settings
Incorrect
In an organization-owned repository, administrators can only opt out of AI Scan once the organization has turned it on.
BShe switches the repository to CodeQL default setup, which turns AI Scan on
Incorrect
AI Scan doesn't depend on CodeQL default setup or on the state of the CodeQL analysis.
CHer developers get GitHub Copilot licenses, which makes the AI Scan setting appear
Incorrect
AI Scan doesn't need a Copilot license.
DAn organization owner or security manager turns AI Scan on for the organization; other repositories can then opt out
Correct
AI Scan is enabled at organization level, and repository administrators can opt out but can't opt in while it is off.
Organization owners and security managers enable AI Scan for pull requests for eligible repositories where code scanning is enabled, and repositories inherit the setting. Administrators of an organization-owned repository can opt out when the organization has enabled it, but they can't opt in while the organization setting is disabled. Because enabling the organization setting turns AI Scan on for every eligible repository at once, billing administrators should review AI credits and budgets first.
An organization on GitHub Team with GitHub Code Security wants one organization-wide ruleset with a code scanning rule for all 80 repositories. The rule isn't offered in the organization ruleset. What is the reason, and the option?
ACode scanning rules need Copilot Autofix enabled first for the organization; enable it, then the rule appears
BCode scanning rules in organization rulesets need a GitHub Enterprise plan; use repository rulesets
CCode scanning rules exist only in tag rulesets; create a tag ruleset
DCode scanning rules require AI Scan; enable AI Scan for the organization
Show the answer and why
ACode scanning rules need Copilot Autofix enabled first for the organization; enable it, then the rule appears
Incorrect
Autofix has no bearing on ruleset availability.
BCode scanning rules in organization rulesets need a GitHub Enterprise plan; use repository rulesets
Correct
Code scanning rules are available at repository level on Team.
CCode scanning rules exist only in tag rulesets; create a tag ruleset
Incorrect
Code scanning rules protect branches.
DCode scanning rules require AI Scan; enable AI Scan for the organization
Incorrect
AI Scan findings can't be used in rulesets.
Code scanning merge protection with rulesets can be set at repository level, and at organization level on GitHub Enterprise plans only. Configuring the rule doesn't enable code scanning itself. AI Scan findings can't be used in rulesets.
Where does an enterprise owner set policies for code security and analysis features?
AIn a repository's Settings, under Advanced Security
BIn the enterprise's Policies tab
CIn dependabot.yml
DIn SECURITY.md
Show the answer and why
AIn a repository's Settings, under Advanced Security
Incorrect
That's repository level.
BIn the enterprise's Policies tab
Correct
The Advanced Security policies page holds them.
CIn dependabot.yml
Incorrect
That file configures Dependabot.
DIn SECURITY.md
Incorrect
That's a reporting policy.
From the enterprise, click Policies, then Advanced Security, to set policies such as the availability of Advanced Security products, dependency insights and Dependabot alerts.
Which enterprise policy decides whether repository administrators can manage AI-generated fix suggestions for code scanning results?
AThe Dependabot alerts policy
BThe repository visibility policy
CThe dependency insights policy
DThe Copilot Autofix policy under Advanced Security
Show the answer and why
AThe Dependabot alerts policy
Incorrect
That policy is about Dependabot.
BThe repository visibility policy
Incorrect
That isn't a security policy for Autofix.
CThe dependency insights policy
Incorrect
That is about dependency visibility.
DThe Copilot Autofix policy under Advanced Security
Correct
That policy covers Autofix for Code Security results.
The Copilot Autofix enterprise policy allows or disallows repository administrators managing where Copilot Autofix is enabled for Code Security results; Code Security must be enabled for the organization. It covers code scanning security queries only.
Which actors can be given bypass permissions for a ruleset?
AOnly organization owners
BOnly individual users
CRoles, teams and GitHub Apps
DNobody; rulesets can't be bypassed
Show the answer and why
AOnly organization owners
Incorrect
Others can be added.
BOnly individual users
Incorrect
Roles, teams and apps can be added.
CRoles, teams and GitHub Apps
Correct
These are eligible for bypass.
DNobody; rulesets can't be bypassed
Incorrect
Bypass lists exist.
When you create a ruleset, you can allow certain actors to bypass it: users with a certain role, such as repository administrator, specific teams, or GitHub Apps.
When delegated bypass is enabled, who decides which individuals, roles or teams review bypass requests?
AOrganization owners or repository administrators
BGitHub Support
CThe secret's provider
DThe contributor who is blocked
Show the answer and why
AOrganization owners or repository administrators
Correct
They choose the reviewers when enabling delegated bypass.
BGitHub Support
Incorrect
Support isn't involved.
CThe secret's provider
Incorrect
Providers aren't involved.
DThe contributor who is blocked
Incorrect
Contributors submit requests.
When enabling delegated bypass for push protection, organization owners or repository administrators decide which individuals, roles or teams can approve or deny bypass requests.