Microsoft Updated GH-500 Exam Questions and Answers by belle

CodeQL query metadata uses the @kind property to identify the type of result a query produces. For a standard or simple alert, the appropriate metadata value is @kind problem. A path-problem query produces an alert accompanied by a sequence of code locations, which is typically used for data-flow or taint-tracking results. @kind diagnostic is intended primarily for extractor troubleshooting information, while @kind metric is used for summary or measurement-oriented results and normally works with corresponding summary metadata. Correctly defining the query kind allows CodeQL and GitHub code scanning to interpret and display query results appropriately. Because the question asks specifically for a simple alert rather than a path-based, diagnostic, or metric result, @kind problem is correct.

Dependency review runs as part of a pull request and shows which dependencies are being added, removed, or changed — and highlights vulnerabilities associated with any added packages.

It works in real-time and is specifically designed for use during pull request workflows.

The dependency graph is an overview, Dependabot alerts notify post-merge, and the Security tab shows the aggregated alert list.

GitHub enables the dependency graph by default for public repositories. The graph analyzes supported manifest and lock files and identifies dependencies declared in those files. When a dependency is added or changed in a supported manifest on the repository's default branch, GitHub updates the dependency graph automatically. Private repositories can also use the dependency graph, but the feature must be enabled unless an organization or enterprise configuration enables it automatically. Forking a repository does not itself constitute the dependency declaration that this question describes. Therefore, under default settings, adding a new dependency to a manifest in a public repository is the scenario that causes GitHub's dependency graph to identify and represent that dependency.

This question is referring to user-facing repository alerts for partner secrets. When GitHub detects authentication credentials belonging to a participating service provider in public content, GitHub can send a partner alert directly to that provider. Partner alerts are not displayed as normal repository secret-scanning alerts to repository administrators. The provider can then validate, revoke, or otherwise remediate the exposed credential. By contrast, newly committed secrets are precisely what secret scanning is designed to detect, changing repository visibility does not suppress scanning, and a revoked credential can still be detected even though validity information may indicate that it is inactive. Thus, interpreted in the context of repository-user reporting, A is the correct answer: supported partner credentials can be reported directly to the issuing provider rather than surfaced as a normal user alert.