[Nov 02, 2025] Microsoft GH-500 Real Exam Questions and Answers FREE [Q30-Q48]

November 2, 2025 admin 0 Comments

5/5 - (2 votes)

[Nov 02, 2025] Microsoft GH-500 Real Exam Questions and Answers FREE

Pass Microsoft GH-500 Exam Info and Free Practice Test

Q30. What is a prerequisite to define a custom pattern for a repository?

Change the repository visibility to Internal

Close other secret scanning alerts

Specify additional match criteria

Enable secret scanning

You must enable secret scanning before defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.
Without enabling secret scanning, GitHub will not process or apply custom patterns.

Q31. Who can fix a code scanning alert on a private repository?

Users who have the Triage role within the repository

Users who have Read permissions within the repository

Users who have Write access to the repository

Users who have the security manager role within the repository

Comprehensive and Detailed Explanation:
In private repositories, users with write access can fix code scanning alerts. They can do this by committing changes that address the issues identified by the code scanning tools. This level of access ensures that only trusted contributors can modify the code to resolve potential security vulnerabilities.
GitHub Docs
Users with read or triage roles do not have the necessary permissions to make code changes, and the security manager role is primarily focused on managing security settings rather than directly modifying code.
Reference:
GitHub Docs

Q32. Which of the following secret scanning features can verify whether a secret is still active?

Push protection

Validity checks

Branch protection

Custom patterns

Validity checks, also called secret validation, allow GitHub to check if a detected secret is still active. If verified as live, the alert is marked as “valid”, allowing security teams to prioritize the most critical leaks.
Push protection blocks secrets but does not check their validity. Custom patterns are user-defined and do not include live checks.

Q33. What is a security policy?

An automatic detection of security vulnerabilities and coding errors in new or modified code

A security alert issued to a community in response to a vulnerability

A file in a GitHub repository that provides instructions to users about how to report a security vulnerability

An alert about dependencies that are known to contain security vulnerabilities

A security policy is defined by a SECURITY.md file in the root of your repository or .github/ directory. This file informs contributors and security researchers about how to responsibly report vulnerabilities. It improves your project’s transparency and ensures timely communication and mitigation of any reported issues.
Adding this file also enables a “Report a vulnerability” button in the repository’s Security tab.

Q34. After investigating a code scanning alert related to injection, you determine that the input is properly sanitized using custom logic. What should be your next step?

Draft a pull request to update the open-source query.

Ignore the alert.

Open an issue in the CodeQL repository.

Dismiss the alert with the reason “false positive.”

When you identify that a code scanning alert is a false positive-such as when your code uses a custom sanitization method not recognized by the analysis-you should dismiss the alert with the reason “false positive.” This action helps improve the accuracy of future analyses and maintains the relevance of your security alerts.
As per GitHub’s documentation:
“If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn’t supported, consider contributing to the CodeQL repository and improving the analysis.” By dismissing the alert appropriately, you ensure that your codebase’s security alerts remain actionable and relevant.

Q35. How would you build your code within the CodeQL analysis workflow? (Each answer presents a complete solution. Choose two.)

Upload compiled binaries.

Use CodeQL’s init action.

Ignore paths.

Implement custom build steps.

Use jobs.analyze.runs-on.

Use CodeQL’s autobuild action.

Comprehensive and Detailed Explanation:
When setting up CodeQL analysis for compiled languages, there are two primary methods to build your code:
GitHub Docs
Autobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.
GitHub Docs
Custom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.
GitHub Docs
The init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.

Q36. When using the advanced CodeQL code scanning setup, what is the name of the workflow file?

codeql-config.yml

codeql-scan.yml

codeql-workflow.yml

codeql-analysis.yml

Comprehensive and Detailed Explanation:
In the advanced setup for CodeQL code scanning, GitHub generates a workflow file named codeql-analysis.yml. This file is located in the .github/workflows directory of your repository. It defines the configuration for the CodeQL analysis, including the languages to analyze, the events that trigger the analysis, and the steps to perform during the workflow.

Q37. Which key is required in the update settings of the Dependabot configuration file?

rebase-strategy

commit-message

assignees

package-ecosystem

In a dependabot.yml configuration file, package-ecosystem is a required key. It defines the package manager being used in that update configuration (e.g., npm, pip, maven, etc.).
Without this key, Dependabot cannot determine how to analyze or update dependencies. Other keys like rebase-strategy or commit-message are optional and used for customizing behavior.

Q38. Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)

pull_request

workflow_dispatch

trigger

commit

Comprehensive and Detailed Explanation:
Dependency review is triggered by specific events in GitHub workflows:
pull_request: When a pull request is opened, synchronized, or reopened, GitHub can analyze the changes in dependencies and provide a dependency review.
workflow_dispatch: This manual trigger allows users to initiate workflows, including those that perform dependency reviews.
The trigger and commit options are not recognized GitHub Actions events and would not initiate a dependency review.

Q39. What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?

Sort to display the oldest first

Sort to display the newest first

Filter to display active secrets

Select only the custom patterns

The best way to prioritize secret scanning alerts is to filter by active secrets – these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.
Sorting by time or filtering by custom patterns won’t help with risk prioritization directly.

Q40. Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?

An enterprise administrator

A user who has write access to the repository

A user who has read access to the repository

A repository member of an enterprise organization

Comprehensive and Detailed Explanation:
By default, users with write access to a repository have the ability to merge pull requests, including those created by Dependabot for security updates. This access level allows contributors to manage and integrate changes, ensuring that vulnerabilities are addressed promptly.
Users with only read access cannot merge pull requests, and enterprise administrators do not automatically have merge rights unless they have write or higher permissions on the specific repository.

Q41. What do you need to do before you can define a custom pattern for a repository?

Provide a regular expression for the format of your secret pattern.

Add a secret scanning custom pattern.

Enable secret scanning on the repository.

Provide match requirements for the secret format.

Stack Overflow
Explanation:
Comprehensive and Detailed Explanation:
Before defining a custom pattern for secret scanning in a repository, you must enable secret scanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.
Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.

Q42. How many alerts are created when two instances of the same secret value are in the same repository?

When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.
This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.

Q43. Which of the following is the best way to prevent developers from adding secrets to the repository?

Create a CODEOWNERS file

Configure a security manager

Enable push protection

Make the repository public

The best proactive control is push protection. It scans for secrets during a git push and blocks the commit before it enters the repository.
Other options (like CODEOWNERS or security managers) help with oversight but do not prevent secret leaks.
Making a repo public would increase the risk, not reduce it.

Q44. What combination of security measures helps to mitigate risks throughout the SDLC (Software Development Life Cycle)?

Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies

Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository’s code

View alerts about dependencies that are known to contain security vulnerabilities

Automatically raise pull requests, which reduces your exposure to older versions of dependencies

These three features provide a complete layer of defense:
Code scanning identifies security flaws in your source code
Secret scanning detects exposed credentials
Dependency review shows the impact of package changes during a pull request Together, they give developers actionable insight into risk and coverage throughout the SDLC.

Q45. You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?

When Dependabot creates a pull request to update dependencies

When you dismiss the Dependabot alert

When the pull request checks are successful

When you merge a pull request that contains a security update

A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.
Simply generating a PR or passing checks does not change the alert status; merging is the key step.

Q46. Which of the following Watch settings could you use to get Dependabot alert notifications? (Each answer presents part of the solution. Choose two.)

The Custom setting

The Participating and @mentions setting

The All Activity setting

The Ignore setting

Comprehensive and Detailed Explanation:
To receive Dependabot alert notifications for a repository, you can utilize the following Watch settings:
Custom setting: Allows you to tailor your notifications, enabling you to subscribe specifically to security alerts, including those from Dependabot.
All Activity setting: Subscribes you to all notifications for the repository, encompassing issues, pull requests, and security alerts like those from Dependabot.
The Participating and @mentions setting limits notifications to conversations you’re directly involved in or mentioned, which may not include security alerts. The Ignore setting unsubscribes you from all notifications, including critical security alerts.
GitHub Docs
+1
GitHub Docs
+1

Q47. Secret scanning will scan:

A continuous integration system.

Any Git repository.

The GitHub repository.

External services.

Secret scanning is a feature provided by GitHub that scans the contents of your GitHub repositories for known types of secrets, such as API keys and tokens. It operates within the GitHub environment and does not scan external systems, services, or repositories outside of GitHub. Its primary function is to prevent the accidental exposure of sensitive information within your GitHub-hosted code.

Q48. Why should you dismiss a code scanning alert?

If you fix the code that triggered the alert

To prevent developers from introducing new problems

If it includes an error in code that is used only for testing

If there is a production error in your code

You should dismiss a code scanning alert if the flagged code is not a true security concern, such as:
Code in test files
Code paths that are unreachable or safe by design
False positives from the scanner
Fixing the code would automatically resolve the alert – not dismiss it. Dismissing is for valid exceptions or noise reduction.

Loading …