GH-500 무료 덤프문제 온라인 액세스

Which of the following options would close a Dependabot alert?

• A.leaving the repository in its current state
• B.viewing the dependency graph
• C.viewing the Dependabot alert on the Dependabot alerts tab of your repository
• D.creating a pull request to resolve the vulnerability that will be approved and merged

Which GitHub security feature should you use to see details of any vulnerable dependency versions within a pull request?

• A.dependency review
• B.code scanning
• C.dependency graph
• D.Dependabot alerts

Who can fix a code scanning alert on a private repository?

• A.users who have the Triage role within the repository
• B.users who have the security manager role within the repository
• C.users who have Write access to the repository
• D.users who have Read permissions within the repository

Hotspot Question
You have a GitHub Enterprise Cloud Organization that uses GitHub Advanced Security code scanning with CodeQL advanced setup. The organization contains multiple repositories that store Java and Kotlin source code.
The repositories use inconsistent CodeQL query pack versions.
You need to ensure that all the repositories run a specific CodeQL query pack version during analysis.
How should you complete the workflow YAML code? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

정답:

Explanation:
Box 1: analyze
The analyze action runs the actual CodeQL analysis on the compiled codebase.
Box 2: autobuild
Compiled languages like Java and Kotlin require a build step before analysis; autobuild attempts to automatically compile the code.
Reference:
https://github.blog/changelog/2024-03-26-codeql-can-scan-java-projects-without-a-build/

You have enabled Dependabot alerts on your repository. If Dependabot detects a vulnerable dependency, it sends an alert when:

• A.the vulnerability is removed from the GitHub Advisory Database.
• B.manifests and lock files are out of date and a version needs to be updated.
• C.a contributor adds the vulnerable dependency to a manifest in the repository.
• D.a contributor makes a change to a function in the code.