Explain alert access management, roles, delegated bypass, and enforcement, and describe supply chain security concepts across the SDLC.

A security manager team has been granted the security manager role at organisation level. A repository in that organisation also restricts who may dismiss Dependabot alerts. A member of the security manager team needs to dismiss a Dependabot alert in that repository as not affecting the project. They have no other team membership granting write access to the repository. What can they do with respect to that alert?

• AThey can view the alert but cannot dismiss it, because dismissing a Dependabot alert always requires write access to the repository in addition to any security role.
• BThey can view and dismiss the alert, because the security manager role grants read access to repositories plus the ability to view and manage security alerts and configuration organisation-wide.check_circle Correct
• CThey can dismiss the alert only after an organisation owner adds them to the repository as an administrator for the duration of the triage.
• DThey can dismiss the alert but the dismissal is recorded as anonymous, because security managers act on behalf of the organisation rather than as individual users.

Why A is wrong: This is the trap for candidates who remember that ordinary alert dismissal needs write access; the security manager role grants alert management across the organisation precisely so security staff can dismiss without separate write access, so the absolute claim is wrong.

Why B is correct: The security manager role is designed to let a non-administrative security function triage and dismiss alerts across every repository in the organisation, with read access to code, without granting general write or admin, which is exactly this scenario.

Why C is wrong: Requiring temporary admin defeats the purpose of the security manager role and overstates the access needed; the role already covers alert management, so this is an unnecessary and incorrect escalation.

Why D is wrong: Dismissals are attributed to the acting user for the audit trail regardless of role; the idea of anonymous organisational dismissal is fabricated, so this is wrong even though it sounds like a governance nicety.