Free Microsoft GH-500 Exam Dumps Questions & Answers

Hotspot Question
You have a GitHub Enterprise Cloud Organization that uses GitHub Code Security.
You need to create a security campaign to remediate cross-site scripting (XSS) vulnerabilities identified by code scanning. The campaign must meet the following requirements:
- Include only alerts that support automatic remediation.
- Include only alerts associated with cross-site scripting (CWE-79).
- Enable eligible security administrators to manage and track the
campaign.
How should you configure the campaign? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Box 1: cwe:79 autofix:supported
To target code scanning alerts for your security campaign that specifically associate with cross- site scripting (CWE-79) and support automatic remediation via Copilot Autofix, you should use the following alert selection filter string:
To narrow your security campaign to exactly what you need, use the following syntax in the search/filter bar: cwe:79 autofix:supported Box 2: Select organization owners or security managers as campaign managers.
To configure campaign managers for a security campaign in a GitHub Enterprise Cloud Organization, you must grant the eligible administrators either the Organization Owner role or the Security Manager role. Only users assigned to these specific roles have the mandatory, organization-wide administrative privileges required to create, manage, and track security campaigns.
Reference:
https://docs.github.com/en/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale
https://docs.github.com/en/enterprise-cloud@latest/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale

What does a CodeQL database of your repository contain?

• A.a build for Go projects to set up the project
• B.a representation of all of the source code
• C.build commands for C/C++, C#, and Java
• D.a build of the code and extracted data

You have a GitHub Enterprise Cloud Organization.
You enable secret scanning alerts and secret scanning push protection across all repositories.
You review the alerts by using the Overview dashboard of security overview in the GitHub interface.
You need to identify only the secret scanning alerts that were generated when push protection was bypassed.
Which filter should you use?

• A.push_protection.bypassed:true
• B.push_protection:true
• C.secret-scanning-push_protection.bypassed:true
• D.bypassed.secret-scanning:true

Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?

• A.enable all for Dependency graph
• B.enable all for Dependabot alerts
• C.enable all in existing repositories
• D.enable by default for new public repositories

What is a benefit of using a custom CodeQL configuration file?

• A.It disables packs from running the default query suite.
• B.It allows configuration options for multiple repositories in a single place.
• C.It specifies a token that has access to the private repository.
• D.It allows you to schedule the scan.