GitHub Advanced Security Secret Scanning Quiz

1. How can you customize secret scanning patterns in GitHub Advanced Security?

Using custom patterns in repository settings

Creating regular expressions in security policies

Modifying the GitHub secret scanning engine

Both a and b

2. Which best practice helps prevent secrets from being committed in the first place?

Use environment variables and .env files in .gitignore

Store secrets in GitHub repository files

Use plaintext configuration files

Commit secrets then rotate them later

3. True or False: Secret scanning push protection can be enforced at the organization level.

True

False

4. How should you handle a secret scanning alert that is a false positive?

Dismiss it and add to allowlist if needed

Delete the alert from the database

Ignore it permanently

Create a new issue

5. What is the main difference between secret scanning and code scanning?

Secret scanning detects exposed credentials; code scanning finds vulnerabilities

Code scanning detects credentials; secret scanning finds bugs

They are the same feature with different names

Secret scanning only works on private repositories

6. Which of the following secrets require GitHub Advanced Security for detection? (Select all that apply)

GitHub personal access tokens

Private SSH keys

Custom organization secrets

AWS credentials

Submit

7. True or False: Secret scanning alerts are automatically dismissed after 30 days.

True

False

8. What is the recommended action after GitHub detects an exposed API key?

Immediately rotate or revoke the key

Delete the commit

Make the repository private

Ignore if no unauthorized access occurred

9. Which tool integrates with GitHub for scanning secrets in local repositories before pushing?

Git-secrets

TruffleHog

GitHub CLI with secret scanning

All of the above

10. True or False: GitHub secret scanning can detect secrets in commit history.

True

False

11. What is the primary purpose of GitHub secret scanning?

Detect exposed credentials and sensitive tokens in repositories

Monitor user login attempts

Track code review completion

Measure code complexity

12. What does the 'resolved' status mean for a secret scanning alert?

The secret was rotated or revoked

The secret was deleted from the repository

The secret was encrypted

The secret was archived

13. Which REST API endpoint is used to list secret scanning alerts?

/repos/{owner}/{repo}/secret-scanning/alerts

/repos/{owner}/{repo}/alerts

/orgs/{org}/secrets

/repos/{owner}/{repo}/scanning

14. True or False: Secret scanning alerts can only be viewed by organization owners.

True

False

15. What is a push protection in GitHub secret scanning?

Prevents commits with detected secrets from being pushed

Requires code review approval

Blocks all push operations

Encrypts the repository

16. Which of the following is NOT a typical secret scanning partner?

AWS

Slack

GitHub Package Registry

Stripe

17. True or False: Secret scanning for private repositories requires GitHub Advanced Security.

True

False

18. Secret scanning can detect credentials from which of the following? (Select all that apply)

AWS access keys

GitHub personal access tokens

Slack webhooks

Variable names

Submit

19. What happens when GitHub detects a secret in a public repository?

The commit is automatically reverted

GitHub notifies the secret partner and the repository owner

The repository is made private

A pull request review is required

20. Which GitHub feature automatically scans for secrets pushed to public repositories?

Code scanning

Secret scanning for public repositories

Dependency tracking

Branch protection rules

GitHub Advanced Security Secret Scanning Quiz

1. How can you customize secret scanning patterns in GitHub Advanced Security?

2.

What first name or nickname would you like us to use?

2. Which best practice helps prevent secrets from being committed in the first place?

3. True or False: Secret scanning push protection can be enforced at the organization level.

4. How should you handle a secret scanning alert that is a false positive?

5. What is the main difference between secret scanning and code scanning?

6. Which of the following secrets require GitHub Advanced Security for detection? (Select all that apply)

7. True or False: Secret scanning alerts are automatically dismissed after 30 days.

8. What is the recommended action after GitHub detects an exposed API key?

9. Which tool integrates with GitHub for scanning secrets in local repositories before pushing?

10. True or False: GitHub secret scanning can detect secrets in commit history.

11. What is the primary purpose of GitHub secret scanning?

12. What does the 'resolved' status mean for a secret scanning alert?

13. Which REST API endpoint is used to list secret scanning alerts?

14. True or False: Secret scanning alerts can only be viewed by organization owners.

15. What is a push protection in GitHub secret scanning?

16. Which of the following is NOT a typical secret scanning partner?

17. True or False: Secret scanning for private repositories requires GitHub Advanced Security.

18. Secret scanning can detect credentials from which of the following? (Select all that apply)

19. What happens when GitHub detects a secret in a public repository?

20. Which GitHub feature automatically scans for secrets pushed to public repositories?