2026 Actual Microsoft GH-500 Dumps, Updated Exam Questions for Guaranteed Pass

GH-500 free sample questions and answers

Microsoft GH-500 practice quiz with correct answers for search indexing.

1. Question 1

   -- [Configure and Use Secret Scanning]

   What is the first step you should take to fix an alert in secret scanning?

   AArchive the repository.
   

   BUpdate your dependencies.
   

   CRevoke the alert if the secret is still valid.
   

   DRemove the secret in a commit to the main branch.
   

   Correct answer: C

   The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.

   Simply deleting the secret from the code does not remove the risk if it hasn't been revoked --- especially since it may already be exposed in commit history.

   
   

2. Question 2

   -- [Describe GitHub Advanced Security Best Practices]

   What kind of repository permissions do you need to request a Common Vulnerabilities and Exposures (CVE) identification number for a security advisory?

   AMaintain
   

   BAdmin
   

   CTriage
   

   DWrite
   

   Correct answer: B

   Requesting a CVE ID for a security advisory in a GitHub repository requires Admin permissions. This level of access is necessary because it involves managing sensitive security information and coordinating with external entities to assign a CVE, which is a formal process that can impact the public perception and security posture of the project.

   
   

3. Question 3

   -- [Configure and Use Secret Scanning]

   What do you need to do before you can define a custom pattern for a repository?

   AProvide a regular expression for the format of your secret pattern.
   

   BAdd a secret scanning custom pattern.
   

   CEnable secret scanning on the repository.
   

   DProvide match requirements for the secret format.
   Stack Overflow
   

   Correct answer: C

   Comprehensive and Detailed Explanation:

   Before defining a custom pattern for secret scanning in a repository, you must enable secret scanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.

   Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.

   
   

4. Question 4

   -- [Configure and Use Dependency Management]

   Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?

   AEnable all in existing repositories
   

   BEnable by default for new public repositories
   

   CEnable all for Dependabot alerts
   

   DEnable all for Dependency graph
   

   Correct answer: C

   To ensure you're notified whenever a vulnerability is detected via Dependabot, you must enable alerts for Dependabot in your personal notification settings. This applies to both new and existing repositories. It ensures you get timely alerts about security vulnerabilities.

   The dependency graph must be enabled for scanning, but does not send alerts itself.

   
   

5. Question 5

   -- [Use Code Scanning with CodeQL]

   How would you build your code within the CodeQL analysis workflow? (Each answer presents a complete solution. Choose two.)

   AUpload compiled binaries.
   

   BUse CodeQL's init action.
   

   CIgnore paths.
   

   DImplement custom build steps.
   

   EUse jobs.analyze.runs-on.
   

   FUse CodeQL's autobuild action.
   

   Correct answer: D, F

   Comprehensive and Detailed Explanation:

   When setting up CodeQL analysis for compiled languages, there are two primary methods to build your code:

   GitHub Docs

   Autobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.

   GitHub Docs

   Custom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.

   GitHub Docs

   The init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.