A central security team holds the security manager role and wants to standardise which security features are enabled across the organisation by authoring and applying a custom security configuration, in addition to triaging alerts. They also want to confirm whether holding the security manager role lets them define and apply that configuration themselves, or whether they need a different grant. Which statement correctly describes what the security manager role permits here?
- AThe security manager role lets the team manage the organisation's security configurations, so they can author a custom configuration and apply it to repositories, alongside their alert triage, without needing organisation owner rights for this. Correct
- BThe security manager role lets them view alerts but not security settings, so they can triage findings yet must ask an organisation owner to author and apply the security configuration on their behalf.
- CThe security manager role grants full organisation ownership for security purposes, so the team can author the configuration, apply it, and also change organisation billing and membership while they are doing security work.
- DThe security manager role only applies to repositories the team already has write access to, so they can configure security on those repositories but the configuration cannot be applied organisation-wide from this role.
Why A is correct: The security manager role is designed to manage an organisation's security settings, which includes authoring and applying security configurations as well as triaging alerts across repositories, so the team can perform this standardisation work without being made organisation owners.
Why B is wrong: This understates the role by limiting it to viewing alerts only, which is tempting because the role is alert-focused, but the role also grants management of security settings and configurations, so the claim that they must defer all configuration work to an owner is incorrect.
Why C is wrong: It is true the role can manage the configuration, which makes the first half believable, but the role deliberately withholds owner powers such as billing and membership control, so describing it as full ownership for security purposes overstates the grant.
Why D is wrong: This wrongly ties the role's reach to existing write access, echoing the real fact that the role does not grant write, but the role's security management and read scope is organisation-wide, so the claim that configuration cannot be applied beyond write-accessible repositories is mistaken.