実用的なGitHub-Advanced-Securityオンライン試験試験-試験の準備方法-効果的なGitHub-Advanced-Security認定デベロッパーCertShikenの専門家チームが彼ら自分の知識と経験を使って多くの人の夢が実現させるIT関連の認証試験の問題集を研究し続けています。CertShikenが提供したGitHubのGitHub-Advanced-Security試験問題と解答が真実の試験の練習問題と解答は最高の相似性があります。CertShikenがあなたの夢が実現させるサイトでございます。 GitHub Advanced Security GHAS Exam 認定 GitHub-Advanced-Security 試験問題 (Q68-Q73):質問 # 68
Which of the following benefits do code scanning, secret scanning, and dependency review provide?
A. Automatically raise pull requests, which reduces your exposure to older versions of dependencies
B. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies
C. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository's code
D. View alerts about dependencies that are known to contain security vulnerabilities
正解：B
解説：
These three features provide a complete layer of defense:
* Code scanningidentifies security flaws in your source code
* Secret scanningdetects exposed credentials
* Dependency reviewshows the impact of package changes during a pull request Together, they give developers actionable insight into risk and coverage throughout the SDLC.
質問 # 69
Which of the following options would close a Dependabot alert?
A. Creating a pull request to resolve the vulnerability that will be approved and merged
B. Viewing the dependency graph
C. Viewing the Dependabot alert on the Dependabot alerts tab of your repository
D. Leaving the repository in its current state
正解：A
解説：
ADependabot alertis only marked asresolvedwhen the related vulnerability is no longer present in your code
- specifically after youmerge a pull requestthat updates the vulnerable dependency.
Simply viewing alerts or graphs doesnotaffect their status. Ignoring the alert by leaving the repo unchanged keeps the vulnerability active and unresolved.
質問 # 70
After investigating a code scanning alert related to injection, you determine that the input is properly sanitized using custom logic. What should be your next step?
A. Open an issue in the CodeQL repository.
B. Ignore the alert.
C. Draft a pull request to update the open-source query.
D. Dismiss the alert with the reason "false positive."
正解：D
解説：
When you identify that a code scanning alert is a false positive-such as when your code uses a custom sanitization method not recognized by the analysis-you should dismiss the alert with the reason "false positive." This action helps improve the accuracy of future analyses and maintains the relevance of your security alerts.
As per GitHub's documentation:
"If you dismiss a CodeQL alert as a false positive result, for example because the code uses a sanitization library that isn't supported, consider contributing to the CodeQL repository and improving the analysis." By dismissing the alert appropriately, you ensure that your codebase's security alerts remain actionable and relevant.
質問 # 71
What happens when you enable secret scanning on a private repository?
A. Dependency review, secret scanning, and code scanning are enabled.
B. GitHub performs a read-only analysis on the repository.
C. Your team is subscribed to security alerts.
D. Repository administrators can view Dependabot alerts.
正解：B
解説：
When secret scanning is enabled on a private repository,GitHub performs a read-only analysisof the repository's contents. This includes the entire Git history and files to identify strings that match known secret patterns or custom-defined patterns.
GitHub does not alter the repository, and enabling secret scanningdoes not automatically enablecode scanning or dependency review - each must be configured separately.
質問 # 72
What is a prerequisite to define a custom pattern for a repository?
A. Close other secret scanning alerts
B. Specify additional match criteria
C. Change the repository visibility to Internal
D. Enable secret scanning
正解：D
解説：
Youmust enable secret scanningbefore defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.
Without enabling secret scanning, GitHub will not process or apply custom patterns.