GH-500 - Security operations: best practices, prioritization, and remediation - Section 5.4

Manage security roles, delegated exceptions, and alert ownership, and enforce cross-suite rulesets, policies, and collaboration on alerts.

Manage security roles including the security manager role to grant fine-grained alert ownership across teams, and configure delegated exceptions so developers can request bypasses with documented justification. Enforce cross-suite rulesets and policies to maintain consistent security posture across Code Security, Secret Protection, and Supply Chain Security.

security manager roledelegated exceptionsalert ownershipcross-suite rulesets

Practice question for this objective

Free sampleSecurity operations: best practices, prioritization, and remediationmedium

A central security team holds the security manager role and wants to standardise which security features are enabled across the organisation by authoring and applying a custom security configuration, in addition to triaging alerts. They also want to confirm whether holding the security manager role lets them define and apply that configuration themselves, or whether they need a different grant. Which statement correctly describes what the security manager role permits here?

  • AThe security manager role lets the team manage the organisation's security configurations, so they can author a custom configuration and apply it to repositories, alongside their alert triage, without needing organisation owner rights for this. Correct
  • BThe security manager role lets them view alerts but not security settings, so they can triage findings yet must ask an organisation owner to author and apply the security configuration on their behalf.
  • CThe security manager role grants full organisation ownership for security purposes, so the team can author the configuration, apply it, and also change organisation billing and membership while they are doing security work.
  • DThe security manager role only applies to repositories the team already has write access to, so they can configure security on those repositories but the configuration cannot be applied organisation-wide from this role.
Recognise that the security manager role can author and apply organisation security configurations without organisation owner rights. Beyond viewing and dismissing alerts across all repositories, the security manager role grants management of the organisation's security settings, which includes creating and applying security configurations. The team can therefore standardise feature enablement organisation-wide from this role without being made organisation owners, while still lacking owner-only powers such as billing and membership control and lacking write access to code.

Why A is correct: The security manager role is designed to manage an organisation's security settings, which includes authoring and applying security configurations as well as triaging alerts across repositories, so the team can perform this standardisation work without being made organisation owners.

Why B is wrong: This understates the role by limiting it to viewing alerts only, which is tempting because the role is alert-focused, but the role also grants management of security settings and configurations, so the claim that they must defer all configuration work to an owner is incorrect.

Why C is wrong: It is true the role can manage the configuration, which makes the first half believable, but the role deliberately withholds owner powers such as billing and membership control, so describing it as full ownership for security purposes overstates the grant.

Why D is wrong: This wrongly ties the role's reach to existing write access, echoing the real fact that the role does not grant write, but the role's security management and read scope is organisation-wide, so the claim that configuration cannot be applied beyond write-accessible repositories is mistaken.

See more GH-500 practice questions, answers explained.

More in this domain

Back to all Security operations: best practices, prioritization, and remediation objectives, or the GH-500 cert hub.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.