GH-500 - Security operations: best practices, prioritization, and remediation (18% of the exam) - Section 5.4

Manage security roles, delegated exceptions, and alert ownership, and enforce cross-suite rulesets, policies, and collaboration on alerts.

Manage security roles including the security manager role to grant fine-grained alert ownership across teams, and configure delegated exceptions so developers can request bypasses with documented justification. Enforce cross-suite rulesets and policies to maintain consistent security posture across Code Security, Secret Protection, and Supply Chain Security.

security manager roledelegated exceptionsalert ownershipcross-suite rulesets

Practice question for this objective

Free sampleSecurity operations: best practices, prioritization, and remediationmedium

A central security team holds the security manager role and wants to standardise which security features are enabled across the organisation by authoring and applying a custom security configuration, in addition to triaging alerts. They also want to confirm whether holding the security manager role lets them define and apply that configuration themselves, or whether they need a different grant. Which statement correctly describes what the security manager role permits here?

AThe security manager role lets the team manage the organisation's security configurations, so they can author a custom configuration and apply it to repositories, alongside their alert triage, without needing organisation owner rights for this. Correct
BThe security manager role lets them view alerts but not security settings, so they can triage findings yet must ask an organisation owner to author and apply the security configuration on their behalf.
CThe security manager role grants full organisation ownership for security purposes, so the team can author the configuration, apply it, and also change organisation billing and membership while they are doing security work.
DThe security manager role only applies to repositories the team already has write access to, so they can configure security on those repositories but the configuration cannot be applied organisation-wide from this role.

Recognise that the security manager role can author and apply organisation security configurations without organisation owner rights. Beyond viewing and dismissing alerts across all repositories, the security manager role grants management of the organisation's security settings, which includes creating and applying security configurations. The team can therefore standardise feature enablement organisation-wide from this role without being made organisation owners, while still lacking owner-only powers such as billing and membership control and lacking write access to code.

Why A is correct: The security manager role is designed to manage an organisation's security settings, which includes authoring and applying security configurations as well as triaging alerts across repositories, so the team can perform this standardisation work without being made organisation owners.

Why B is wrong: This understates the role by limiting it to viewing alerts only, which is tempting because the role is alert-focused, but the role also grants management of security settings and configurations, so the claim that they must defer all configuration work to an owner is incorrect.

Why C is wrong: It is true the role can manage the configuration, which makes the first half believable, but the role deliberately withholds owner powers such as billing and membership control, so describing it as full ownership for security purposes overstates the grant.

Why D is wrong: This wrongly ties the role's reach to existing write access, echoing the real fact that the role does not grant write, but the role's security management and read scope is organisation-wide, so the claim that configuration cannot be applied beyond write-accessible repositories is mistaken.

See more GH-500 practice questions, answers explained.

Exam traps in Security operations: best practices, prioritization, and remediation

Answers that look right on this material and are not. Each one is a distractor from a different question in the GH-500 bank for this domain.

The security manager role grants read and write across every repository in the organisation, so the push should have succeeded, and the rejection indicates a branch protection rule requiring a pull request rather than a role limitation.
Why it is wrong: It is tempting to assume a role broad enough to triage alerts everywhere must also carry write everywhere, and branch protection can indeed block direct pushes, but the role does not grant write across the organisation at all, so attributing the rejection solely to branch protection misreads the underlying permission boundary.
Every alert still attached to the campaign is automatically dismissed once the due date passes, so the campaign backlog is cleared and the campaign is marked complete.
Why it is wrong: A campaign never changes alert state on its own, so a passed deadline does not auto-dismiss the remaining open alerts. This is tempting because a deadline feels like a hard cutoff, but auto-dismissal would hide unremediated risk, which is the opposite of what a campaign is for.
Add a branch protection rule in each repository that requires the CodeQL status check to pass, since a failing check from any severity alert will block the merge until it is resolved.
Why it is wrong: Per-repository branch protection that only requires the analysis check to pass cannot distinguish severities and must be set up repository by repository, which violates the requirement for consistent organisation-wide enforcement. It also tends to block on any failing result rather than only on high or critical alerts.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.