合格させるGH-500試験一発合格保証100%カバー率でリアル試験問題 [2026年08月]
有効なGH-500テスト解答Microsoft GH-500試験PDF問題を試そう
質問 # 74
You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? Each answer presents part of the solution. (Choose two.)
- A. in the dependency graph
- B. in manifest and lock files
- C. in the National Vulnerability Database
- D. in security advisories reported on GitHub
正解：B、D
解説：
C: GitHub may send Dependabot alerts to repositories affected by a vulnerability disclosed by a recently published GitHub security advisory.
D: The Dependabot security updates feature is available for repositories where you have enabled the dependency graph and Dependabot alerts. You will see a Dependabot alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file.
質問 # 75
What does a CodeQL database of your repository contain?
- A. build commands for C/C++, C#, and Java
- B. a build of the code and extracted data
- C. a build for Go projects to set up the project
- D. a representation of all of the source code
正解：B
解説：
CodeQL databases contain queryable data extracted from a codebase, for a single language at a particular point in time. The database contains a full, hierarchical representation of the code, including a representation of the abstract syntax tree, the data flow graph, and the control flow graph.
Each language has its own unique database schema that defines the relations used to create a database. The schema provides an interface between the initial lexical analysis during the extraction process, and the actual complex analysis using CodeQL. The schema specifies, for instance, that there is a table for every language construct.
For each language, the CodeQL libraries define classes to provide a layer of abstraction over the database tables. This provides an object-oriented view of the data which makes it easier to write queries.
質問 # 76
You are managing code scanning alerts for your repository. You receive an alert highlighting a problem with data flow. What do you click for additional context on the alert?
- A. Code scanning alerts
- B. Security
- C. Show paths
正解：C
解説：
When dealing with a data flow issue in a code scanning alert, clicking on "Show paths" provides a detailed view of the data's journey through the code. This includes the source of the data, the path it takes, and where it ends up (the sink). This information is crucial for understanding how untrusted data might reach sensitive parts of your application and helps in identifying where to implement proper validation or sanitization.
質問 # 77
How does Dependabot use the dependency graph in GitHub Advanced Security (GHAS)?
- A. To identify and address security vulnerabilities in the codebase.
- B. To automatically update project dependencies to their latest, secure versions.
- C. To generate alerts for potential security vulnerabilities in project dependencies.
- D. To cross-reference dependency data with the GitHub Advisory Database.
正解：D
質問 # 78
Hotspot Question
You have a GitHub Enterprise Cloud Organization that uses GitHub Advanced Security and runs CodeQL code scanning on pull requests (PRs).
You discover that a specific CodeQL alert is a false positive and must be closed without changing the code.
You need to dismiss the alert as a false positive result and add a dismissal comment.
How should you complete the GitHub CLI command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
Box 1: Gh
gh is the core executable command for the GitHub CLI tool. All GitHub CLI commands start with gh followed by the specific extension or API flag.
Box 2: ${owner}/${repo}
{owner}/{repo} represents the repository path required by the GitHub REST API endpoint. For an enterprise cloud organization, {owner} is your GitHub Organization name and {repo} is the specific repository name where the alert resides (e.g., my-org/my-application).
Reference:
https://cve.akaoma.com/cve-2023-3883
質問 # 79
What is the first step you should take to fix an alert in secret scanning?
- A. Revoke the alert if the secret is still valid.
- B. Update your dependencies.
- C. Archive the repository.
- D. Remove the secret in a commit to the main branch.
正解：A
解説：
The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.
Simply deleting the secret from the code does not remove the risk if it hasn't been revoked - especially since it may already be exposed in commit history.
質問 # 80
Which security feature shows a vulnerable dependency in a pull request?
- A. Dependabot alert
- B. Dependency graph
- C. Dependency review
- D. The repository's Security tab
正解：C
解説：
Dependency review runs as part of a pull request and shows which dependencies are being added, removed, or changed - and highlights vulnerabilities associated with any added packages.
It works in real-time and is specifically designed for use during pull request workflows.
The dependency graph is an overview, Dependabot alerts notify post-merge, and the Security tab shows the aggregated alert list.
質問 # 81
Which of the following is the most complete method for Dependabot to find vulnerabilities in third-party dependencies?
- A. CodeQL analyzes the code and raises vulnerabilities in third-party dependencies
- B. A dependency graph is created, and Dependabot compares the graph to the GitHub Advisory database
- C. Dependabot reviews manifest files in the repository
- D. The build tool finds the vulnerable dependencies and calls the Dependabot API
正解：B
解説：
Dependabot builds a dependency graph by analyzing package manifests and lockfiles in your repository. This graph includes both direct and transitive dependencies. It then compares this graph against the GitHub Advisory Database, which includes curated, security-reviewed advisories.
This method provides a comprehensive and automated way to discover all known vulnerabilities across your dependency tree.
質問 # 82
When using the advanced CodeQL code scanning setup, what is the name of the workflow file?
- A. codeql-scan.yml
- B. codeql-workflow.yml
- C. codeql.yml
- D. codeql-config.yml
正解：C
解説：
If you already enabled CodeQL with the default settings, select the menu labeled "...", then select Switch to advanced. Select Disable CodeQL when prompted. Don't worry, we will re-enable it after we've completed the advanced setup process.
After selecting or switching to advanced, you'll be taken to a GitHub Actions workflow file named codeql.yml. You can find it in your Web Goat repository's /.github/workflows directory. This is the file we use to run and configure CodeQL.
質問 # 83
Which of the following statements best describes secret scanning push protection?
- A. Secret scanning alerts must be closed before a branch can be merged into the repository.
- B. Users need to reply to a 2FA challenge before any push events.
- C. Commits that contain secrets are blocked before code is added to the repository.
- D. Buttons for sensitive actions in the GitHub UI are disabled.
正解：C
解説：
Secret scanning push protection is a security feature that prevents sensitive information like API keys or tokens from being pushed to a repository in the first place. It works by proactively scanning code during the push process and blocking any attempts to commit secrets. This differs from regular secret scanning, which only detects secrets after they have been committed.
質問 # 84
You have a GitHub Enterprise Cloud Organization that contains a private repository named Repo1 and has GitHub Secret Protection enabled. Repo1 contains a workflow that writes an access key ID to config.txt and a secret access key to secrets.txt. Repo1 has secret scanning push protection enabled.
You discover that a developer at your company was able to push changes that contain both the access key ID and the secret access key without the push being blocked.
What is the cause of the issue?
- A. The push did NOT include a merge into the default branch.
- B. The push did NOT include a merge into the default branch.
- C. The secrets were stored in separate files.
- D. The developer performed the push from the command line.
正解：C
解説：
Secret validation rules: GitHub's secret scanning push protection for AWS credentials checks for a high-confidence pair (the Access Key ID and Secret Access Key) appearing together within the same file or immediate context to prevent false positives.
Separation bypasses detection: Because the developer placed the Access Key ID in config.txt and the Secret Access Key in secrets.txt, the push protection pattern matching did not recognize them as a coupled, valid secret pair, allowing the push to succeed.
Incorrect:
[Not B] The push did NOT include a merge into the default branch:
This is incorrect because push protection scans all pushes to any branch within the repository, not just the default branch, to prevent secrets from entering the commit history anywhere.
[Not C] The push was performed on a private repository:
This is incorrect because GitHub Enterprise Cloud organizations can enable secret scanning and push protection for both public and private repositories alike.
Reference:
https://rogierdijkman.medium.com/privilege-escalation-via-storage-accounts-bca24373cc2e
質問 # 85
Where can you use CodeQL analysis for code scanning? (Each answer presents part of the solution. Choose two.)
- A. In the Files changed tab of the pull request
- B. In a workflow
- C. In a third-party Git repository
- D. In an external continuous integration (CI) system
正解：B、D
解説：
In a workflow: GitHub Actions workflows are the most common place for CodeQL code scanning. The codeql-analysis.yml defines how the analysis runs and when it triggers.
In an external CI system: GitHub allows you to run CodeQL analysis outside of GitHub Actions. Once complete, the results can be uploaded using the upload-sarif action to make alerts visible in the repository.
You cannot run or trigger analysis from third-party repositories directly, and the Files changed tab in pull requests only shows diff - not analysis results.
質問 # 86
You have a GitHub repository named Repo1that runs CodeQL code scanning. Repo1contains both Java and Kotlin source code. Repo1generates additional source files during compilation.
Recent alerts indicate that Kotlin files cannot be processed without a build.
You need to ensure that CodeQL analyzes both the Java files and the Kotlin files and includes the generated source files in the CodeQL database.
What should you do?
- A. Set the CodeQL build mode to autobuild.
- B. Set the CodeQL build mode to manual.
- C. Add Kotlin to the CodeQL languages list.
- D. Set the CodeQL build mode to none.
正解：C
解説：
To fix this issue, you must switch your CodeQL workflow execution configuration from using the default "none" build mode to a manual build step configuration. For repositories that mix Java and Kotlin alongside dynamic code generation during compilation, explicit build commands ensure CodeQL intercepts the compilation process to catalog the generated source files and analyze the Kotlin files completely.
Update the CodeQL Initialization Language Matrix
Ensure CodeQL treats both languages as unified by specifying java-kotlin inside your initialization step.
Update the languages parameter in the github/codeql-action/init step.Use java-kotlin instead of java to instruct the extractor to capture both source formats.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: 'java-kotlin'
# Optional: explicitly tell CodeQL not to run default build-mode none
build-mode: 'manual'
Reference:
https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build
質問 # 87
Which of the following features can be used to enforce passing status checks for code scanning and dependency review workflows?
- A. security GuardRails
- B. repository rulesets
- C. status enforcement
- D. Insights
正解：B
質問 # 88
You are configuring code scanning with CodeQL. What is one impact of using a language matrix in your workflow?
- A. CodeQL excludes alerts for those dependencies specified in the language matrix.
- B. You can use the languages parameter under the init action.
- C. CodeQL will only analyze the languages in the matrix.
- D. CodeQL is configured to run analysis sequentially.
正解：C
質問 # 89
When does Dependabot alert you of a vulnerability in your software development process?
- A. as soon as a pull request is opened by a contributor
- B. when a pull request adding a vulnerable dependency is opened
- C. as soon as a vulnerable dependency is detected
- D. when Dependabot opens a pull request to update a vulnerable dependency
正解：C
解説：
Dependabot alerts are generated as soon as GitHub detects a known vulnerability in one of your dependencies. GitHub does this by analyzing your repository's dependency graph and matching it against vulnerabilities listed in the GitHub Advisory Database. Once a match is found, the system raises an alert automatically without waiting for a PR or manual action.
This allows organizations to proactively mitigate vulnerabilities as early as possible, based on real-time detection.
質問 # 90
A secret scanning alert should be closed as "used in tests" when a secret is:
- A. In the readme.md file.
- B. In a test file.
- C. Not a secret in the production environment.
- D. Solely used for tests.
正解：D
解説：
If a secret is intentionally used in a test environment and poses no real-world security risk, you may close the alert with the reason "used in tests". This helps reduce noise and clarify that the alert was reviewed and accepted as non-critical.
Just being in a test file isn't enough unless its purpose is purely for testing.
質問 # 91
What is code scanning?
- A. a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors
- B. a feature to identify all your project's dependencies
- C. a feature that scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally
- D. a feature to privately discuss, fix, and publish information about security vulnerabilities in your repository
正解：A
解説：
GitHub's Code scanning is a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors, providing alerts in the repository and offering tools to triage, prioritize, and fix issues. It acts as a Static Application Security Testing (SAST) tool, using engines like CodeQL to detect issues like SQL injection and Cross-Site Scripting (XSS), and can be triggered automatically on events like pushes and pull requests.
質問 # 92
Why should you dismiss a code scanning alert?
- A. If you fix the code that triggered the alert
- B. If it includes an error in code that is used only for testing
- C. To prevent developers from introducing new problems
- D. If there is a production error in your code
正解：B
解説：
You should dismiss a code scanning alert if the flagged code is not a true security concern, such as:
Code in test files
Code paths that are unreachable or safe by design
False positives from the scanner
Fixing the code would automatically resolve the alert - not dismiss it. Dismissing is for valid exceptions or noise reduction.
質問 # 93
What happens when you enable secret scanning on a private repository?
- A. Repository administrators can view Dependabot alerts.
- B. Your team is subscribed to security alerts.
- C. GitHub performs a read-only analysis on the repository.
- D. Dependency review, secret scanning, and code scanning are enabled.
正解：A
解説：
GitHub secret scanning detects and alerts on sensitive data exposure, such as API keys and credentials, in your code repositories. Use it to protect your secrets, ensure secure and compliant development practices, and reduce the risk of data breaches and unauthorized access.
GitHub has scanned public repositories for secrets (like API keys and tokens) for several years.
Secret scanning protects our partners and our customers from unauthorized use of the services protected by those secrets. Just this month, 8% of active GitHub repositories committed a secret that was caught by secret scanning.
At GitHub Satellite, we announced secret scanning for private repositories, part of GitHub Advanced Security. We're bringing the same lightning-fast scanning engine and broad set of 24 partners (including all the major cloud providers and many common SaaS providers) to your private repository, so you can catch secrets as soon as they're checked in. Repository admins will be notified about any commit that contains a secret, and can quickly view all detected secrets in the repo's Security tab.
質問 # 94
Which of the following options are code scanning application programming interface (API) endpoints? (Each answer presents part of the solution. Choose two.)
- A. Get a single code scanning alert
- B. Delete all open code scanning alerts
- C. Modify the severity of an open code scanning alert
- D. List all open code scanning alerts for the default branch
正解：A、D
解説：
The GitHub Code Scanning API includes endpoints that allow you to:
List alerts for a repository (filtered by branch, state, or tool) - useful for monitoring security over time.
Get a single alert by its ID to inspect its metadata, status, and locations in the code.
However, GitHub does not support modifying the severity of alerts via API - severity is defined by the scanning tool (e.g., CodeQL). Likewise, alerts cannot be deleted via the API; they are resolved by fixing the code or dismissing them manually.
質問 # 95
In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?
- A. Enable Dependabot alerts.
- B. Add Dependabot rules.
- C. Add a workflow with the dependency review action.
- D. Enable Dependabot security updates.
正解：C
解説：
To detect and block vulnerable dependencies before merge, developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.
This is a preventative measure during development, unlike Dependabot, which reacts after the fact.
質問 # 96
Which security feature shows a vulnerable dependency in a pull request?
- A. dependency review
- B. Dependabot alert
- C. the repository's Security tab
- D. dependency graph
正解：A
質問 # 97
A repository's dependency graph includes:
- A. dependencies from all your repositories.
- B. a summary of the dependencies used in your organization's repositories.
- C. annotated code scanning alerts from your repository's dependencies.
- D. dependencies parsed from a repository's manifest and lock files.
正解：D
解説：
The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems, as well as any dependencies that are submitted using the dependency submission API. This includes:
Direct dependencies, that are explicitly defined in a manifest or lock file or have been submitted using the dependency submission API.
Indirect dependencies of these direct dependencies, also known as transitive dependencies or sub-dependencies.
質問 # 98
......
GH-500試験問題にて有効なGH-500問題集PDF：https://www.goshiken.com/Microsoft/GH-500-mondaishu.html
検証済みGH-500問題集と解答で合格保証：https://drive.google.com/open?id=1x4s1tRveRI10bktW_8PTu9Cto3bGO90r