A security lead wants a cross-repository view in Security Overview that aggregates open code scanning, secret scanning, and Dependabot alerts across the organisation's mix of public and private repositories. The organisation has not purchased any GitHub Advanced Security entitlement. They want to know which repositories will contribute alert data to that organisation-level Security Overview under this licensing state. Which repositories will show alerts in the organisation's Security Overview?
- APublic repositories will contribute code scanning and secret scanning alerts plus Dependabot alerts, while private repositories will contribute only Dependabot alerts until GitHub Advanced Security is purchased. Correct
- BAll repositories will contribute code scanning, secret scanning, and Dependabot alerts equally, because Security Overview ignores repository visibility when aggregating.
- CNo repositories will contribute any alerts, because Security Overview is itself a GitHub Advanced Security feature that is dark until an entitlement is purchased.
- DOnly private repositories will contribute alerts, because Security Overview is designed for private estates and excludes public repositories from the organisation view.
Why A is correct: Correct. Without GitHub Advanced Security, public repositories can run the free code scanning and secret scanning and so feed those alerts into Security Overview, while private repositories can only produce the free Dependabot alerts; their code scanning and secret scanning stay unavailable.
Why B is wrong: Tempting because Security Overview does span visibilities, but it can only surface alerts the repositories are entitled to generate, and private repositories cannot produce code scanning or secret scanning alerts without GitHub Advanced Security.
Why C is wrong: Tempting because Security Overview is associated with the security suite, but the organisation-level overview is available and aggregates the alerts that the repositories are entitled to produce, including free Dependabot alerts everywhere.
Why D is wrong: Tempting if the candidate assumes the overview is private-focused, but it includes public repositories, and without an entitlement those public repositories actually contribute the richest free alert set.