Free Microsoft GH-500 Practice Exam with Questions & Answers

A valid Dependabot configuration requires the top-level version and updates keys. The configuration currently uses version: 2, which identifies the Dependabot configuration syntax. The updates section contains one or more configuration entries describing package ecosystems that Dependabot should monitor. Within each update entry, additional required settings include package-ecosystem, directory or directories, and schedule.interval. The top-level registries key is optional and is used when Dependabot needs authentication information for private registries. assignees is also optional and controls which users are automatically assigned to Dependabot-created pull requests. Therefore, although several other properties may appear in a practical configuration file, only version and updates are mandatory top-level keys among the choices provided.

For the secret scanning alerts list view specifically, Admin is the correct choice among the supplied roles. GitHub distinguishes between being able to access information about a particular secret associated with your own commits and having access to the repository-wide secret scanning alert list. GitHub's repository-role documentation notes that users with Write or Maintain roles can directly view secret-scanning information associated with their own commits but cannot access the full alert-list view under the standard role model. Repository administrators have the broader security visibility needed for the complete list. Read access is insufficient, while “repository owner” is not a standard repository role for organization-owned repositories. Additional users can also receive alert access when explicitly granted it by an organization owner or repository administrator.

By default , no repositories receive Dependabot alerts unless configuration is explicitly enabled. GitHub does not enable Dependabot alerts automatically for any repositories unless:

The feature is turned on manually

It's configured at the organization or enterprise level via security policies

This includes public, private, and enterprise-owned repositories — manual activation is required .

Comprehensive and Detailed Explanation:

Before defining a custom pattern for secret scanning in a repository, you must enable secret scanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.​

Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.​

Using the Custom setting allows you to subscribe to specific event types, such as Dependabot alerts or vulnerability notifications, without being overwhelmed by all repository activity. This is essential for repository maintainers who need fine-grained control over what kinds of events trigger notifications.

This setting is configurable per repository and allows users to stay aware of critical issues while minimizing notification noise.

After generating an alert for a vulnerable dependency, Dependabot automatically attempts to create a pull request to upgrade that dependency to the minimum required secure version —if a fix is available and compatible with your project.

This automated PR helps teams fix vulnerabilities quickly with minimal manual intervention. You can also configure update behaviors using dependabot.yml, but in the default state, PR creation is automatic.

GitHub secret scanning examines the repository comprehensively rather than limiting analysis to selected files or dependency metadata. GitHub states that secret scanning scans the entire Git history across all branches for supported secrets. Consequently, both current files and historical versions of files can be inspected, which is why simply deleting a leaked credential in a later commit does not eliminate the security risk. The feature searches repository content for supported provider, generic, and other enabled secret patterns. Dependencies themselves are handled primarily through dependency graph and Dependabot functionality and are not a secret-scanning scope category. Therefore, the correct selections are all branches, the full commit history, and all files in the repository.

You should dismiss a code scanning alert if the flagged code is not a true security concern , such as:

Code in test files

Code paths that are unreachable or safe by design

False positives from the scanner

Fixing the code would automatically resolve the alert — not dismiss it. Dismissing is for valid exceptions or noise reduction.

In a repository's Security tab, you can view:

Secret scanning alerts : Exposed credentials or tokens

Dependabot alerts : Vulnerable dependencies from the advisory database

Code scanning alerts : Vulnerabilities in code detected via static analysis (e.g., CodeQL)

You won’t see general "security status alerts" (not a formal category) or permission-related alerts here.

Known vulnerable dependencies detected in a repository are presented as Dependabot alerts. GitHub uses the dependency graph to determine which packages and versions the repository depends on and compares that information with vulnerability data from the GitHub Advisory Database. When a match is found, an alert appears in the repository's Security and quality area under Dependabot vulnerabilities. Each alert can provide the affected dependency, vulnerability details, severity, the affected manifest or lockfile, and a secure version when one is available. Secret scanning alerts relate to exposed credentials, while code scanning alerts represent vulnerabilities or coding errors in source code. Security advisories are vulnerability records and disclosure mechanisms rather than the repository-specific list of vulnerable dependencies.