GitHub · GH-500
Alerts, responsibilities, and access
GH-500 · Lesson 3 of 16 · 17:48
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: how each suite detects problems, supply chain alerts across the SDLC, triaging and acting on alerts, the risks and best practices of dismissing alerts, the responsibilities of developers, security teams, and administrators, and access to alerts, the security manager role, delegated bypass, and enforcement. Includes three original practice questions.
Preview the topics
- A new advisory is published for a logging library that Contoso’s loan portal uses as a transitive dependency. Which mechanism raises the alert?
- Contoso’s auditors want every dismissal of a code scanning alert in the payments repositories to be justified and approved by the security team. What should the administrators enable?
- Contoso’s application security team needs to see and manage every security alert in the payments organization, without becoming owners or getting write access to code. What should they be given?