Assuming that no custom patterns are configured, what type of secret is detected by secret scanning?

• A. private keys
• B. Personal Identifiable Information (PII)
• C. usernames
• D. sealed boxes

설명: (Fast2test 회원만 볼 수 있음)

Which syntax in a query suite tells CodeQL to look for one or more specified .ql files?

• A. qls
• B. qlpack
• C. query

설명: (Fast2test 회원만 볼 수 있음)

Hotspot Question
You have a GitHub Enterprise Cloud Organization that uses GitHub Code Security.
You need to create a security campaign to remediate cross-site scripting (XSS) vulnerabilities identified by code scanning. The campaign must meet the following requirements:
- Include only alerts that support automatic remediation.
- Include only alerts associated with cross-site scripting (CWE-79).
- Enable eligible security administrators to manage and track the
campaign.
How should you configure the campaign? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:
Box 1: cwe:79 autofix:supported
To target code scanning alerts for your security campaign that specifically associate with cross- site scripting (CWE-79) and support automatic remediation via Copilot Autofix, you should use the following alert selection filter string:
To narrow your security campaign to exactly what you need, use the following syntax in the search/filter bar: cwe:79 autofix:supported Box 2: Select organization owners or security managers as campaign managers.
To configure campaign managers for a security campaign in a GitHub Enterprise Cloud Organization, you must grant the eligible administrators either the Organization Owner role or the Security Manager role. Only users assigned to these specific roles have the mandatory, organization-wide administrative privileges required to create, manage, and track security campaigns.
Reference:
https://docs.github.com/en/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale
https://docs.github.com/en/enterprise-cloud@latest/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale

What is the difference between scheduled versus triggered events in code scanning?

• A. Scheduled events run based on a specified schedule and triggered events run on code events such as a push.
• B. Scheduled events can only be set up by administrators.
• C. Triggered events run less frequently than scheduled events.
• D. Scheduled events are more difficult to configure than triggered events.

You have a GitHub Enterprise subscription that contains multiple organizations. Each organization contains repositories that use GitHub Advanced Security.
You need to manage code security and analysis policies across all the organizations. The solution must ensure that the organization owners can manage repository membership and day- to-day collaboration within their respective organization.
What should you configure?

• A. organization-level repository rules for each organization
• B. repository rulesets for each repository
• C. enterprise policies for code security and analysis
• D. repository branch protection rules for each repository

설명: (Fast2test 회원만 볼 수 있음)