Describe GitHub Security suites, features, and ecosystem

A security lead at a fintech company wants CodeQL code scanning to block pull requests only when a newly introduced alert has a 'critical' or 'high' severity, while allowing lower-severity alerts to be merged after review. Developers should still see all alerts in the PR conversation. Which configuration best achieves this outcome?

A developer at Contoso commits a Python file that both (1) contains an active AWS access key hardcoded in a variable and (2) constructs a SQL query by concatenating unsanitized user input. The security team wants each issue surfaced by the GitHub Advanced Security capability that is purpose-built to detect it. Which pairing correctly maps each issue to the appropriate capability?

A fintech team runs a Node.js payment service. During a single sprint, two problems surface: (1) a developer accidentally commits an AWS access key to a feature branch, and (2) a code review reveals a SQL query built by concatenating untrusted user input. The security lead wants to use the GitHub Advanced Security suites so that each problem is handled by the tool actually designed to address its root cause. Which mapping correctly assigns each issue to the appropriate suite and reflects why they are distinct but complementary?

Your platform team is onboarding a new microservices monorepo. Leadership asks you to clearly delineate which GitHub Advanced Security suite is responsible for each of three concerns: (1) detecting a hardcoded AWS access key committed to source, (2) flagging a known CVE in a third-party npm package the repo depends on, and (3) identifying an SQL injection sink in application code. Which mapping correctly assigns each concern to the appropriate suite?

A security team at a fintech company wants developers to be blocked from merging pull requests that introduce new high-severity code scanning alerts, but they also need a controlled escape hatch: when a genuine business emergency requires a hotfix, a specific group of designated security reviewers should be able to approve the exception rather than any developer simply overriding the block. The team wants this handled natively through GitHub's enforcement mechanisms without disabling the protection entirely. Which approach best meets these requirements?

Your organization has enabled secret scanning push protection across all repositories. A developer on the payments team is legitimately committing a test credential that is triggering push protection and blocking their push. Your security team wants developers to be able to proceed with a documented exception in urgent cases, but they also want every bypass to be reviewed rather than allowing developers to self-approve. Which GitHub capability should you configure to meet this requirement?

A security engineer at a fintech company notices that a critical vulnerability was recently disclosed in a widely-used npm logging library. Several of the company's repositories declare this library in their package-lock.json files. The engineer wants to understand which repositories are affected without manually inspecting each one. Which GitHub supply chain security mechanism identifies affected repositories by comparing their dependency data against known vulnerability records?

A platform team wants to stop new pull requests from introducing dependencies with known vulnerabilities or non-compliant licenses, giving reviewers this information directly in the PR before merge. Dependabot alerts are already enabled, but the team says alerts fire only after code is merged into the default branch. Which Supply Chain Security feature should they add to enforce checks at the pull request stage?

At Meridian Payments, a code scanning alert flagging a potential SQL injection appears on a pull request that a developer opened. The organization follows a prevention-first strategy where developers own remediation of issues surfaced during their work, security engineers set policy and provide guidance, and admins configure enforcement. The developer is unsure how to fix the flagged query and the PR is blocked by a branch protection rule requiring the alert to be resolved. Whose responsibility is it to remediate the code change, and what is the appropriate next step?

A developer at your company notices a secret scanning alert flagging an AWS access key that was committed to a repository three weeks ago. The developer confirms the key is real and is still active in the AWS account. Under time pressure, they consider simply dismissing the alert in GitHub as 'used in tests' so the CI dashboard turns green. As the security lead, what is the most important thing you must communicate about the implications of this action?

A developer at a fintech company is working through a backlog of code scanning alerts before a release deadline. One alert flags a potential SQL injection in a data-access module. The developer is confident the input is already sanitized upstream and wants to remove the alert from the active list without altering the code. They ask the security team what the correct action is and what the downstream implications will be. What should the security team advise?

A security engineer is onboarding a newly imported private repository into the organization's Supply Chain Security program. They want Dependabot alerts to notify maintainers when a dependency has a known vulnerability. After navigating to the repository's security settings, they find the Dependabot alerts toggle is greyed out and cannot be enabled. What must be enabled first to unblock this configuration?

You are a security admin for an enterprise GitHub organization with 300 repositories. Leadership wants a governance approach that guarantees Secret Protection features (secret scanning and push protection) remain enabled on every current repository AND automatically applies to any new repository created in the future, without requiring developers to remember to turn them on. Which approach best satisfies this requirement?

You are the security admin for an organization on GitHub Enterprise Cloud with GitHub Advanced Security enabled. A newly formed application security team needs to view and triage Dependabot alerts across all repositories in the organization, but company policy states they must NOT be granted write/push access to code and must NOT be organization owners. Developers on individual teams should continue to see alerts only for their own repositories. What is the most appropriate way to grant the appsec team the access they need?

A platform engineering team is designing an end-to-end secure SDLC using the GitHub Security suites. They want each suite mapped to the phase where it delivers the most value. Which mapping correctly reflects the primary role of each suite across the development lifecycle?

A platform team is designing the security strategy for a new set of microservice repositories. Leadership wants to minimize the number of vulnerabilities and leaked secrets that ever reach the default branch, rather than relying on catching problems during a final pre-release review. As the security architect, which approach best reflects a prevention-first strategy using the GitHub security suites?

At Meridian Software, a code scanning alert for a potential SQL injection is raised on a pull request. The team is clarifying responsibilities: the developer who opened the PR, the security team that owns organization policy, and the repository admin. According to GitHub's recommended division of responsibilities for handling code scanning alerts, who is primarily responsible for remediating the flagged vulnerability in the code before the PR is merged?

A security engineer at a fintech company receives a secret scanning alert indicating a valid cloud provider API key was committed to a private repository three weeks ago. The commit history shows the key has been present across multiple branches and was pushed before push protection was enabled. According to GitHub's recommended response workflow, what should the engineer do FIRST to properly respond to this alert?

A platform security engineer is designing the rollout of Secret Protection for an organization. Leadership wants to guarantee that most new credentials never reach the default branch history, while also ensuring that credentials already committed in the past are surfaced for remediation. Which combination of Secret Protection capabilities correctly maps to these two distinct goals?

A security engineer at a fintech company is triaging a large backlog of secret scanning alerts. Leadership wants the team to focus first on secrets that pose an active, exploitable risk rather than spending time on credentials that may already be revoked. Which secret scanning capability should the engineer rely on to prioritize alerts for supported partner providers, and how should it guide the response?