GitHub · GH-500
Prioritizing security work at scale
GH-500 · Lesson 13 of 16 · 1:45:40
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: code scanning merge rules with alert thresholds, remediation targets measured by security overview, campaign strategies, bulk alert management with filters and the REST API, and automated dismissals with reasons, comments, approvals, and the audit log. Includes three original practice questions.
Preview the topics
- Contoso’s policy: no pull request may merge into main with a new critical or high CodeQL security alert, while lower findings are only tracked. How should the code scanning rule be set?
- Contoso wants to fix 800 cross-site scripting alerts over 90 repositories, with developers learning from each fix and a deadline at the end of the quarter. Which strategy fits?
- Contoso’s auditors ask for evidence of who approved each dismissed secret scanning alert in the payments organization, and why. What provides this?