An enterprise owner on GitHub Enterprise Cloud wants one named baseline that enables secret scanning with push protection and code scanning, and wants it offered to every organisation in the enterprise so each organisation owner can apply it without rebuilding it. The owner does not want to log in to each organisation to recreate the same settings. Which mechanism lets the owner author the baseline once at the enterprise tier and make it available to the organisations beneath it?
- ACreate the security configuration inside each organisation, then export and import the JSON between organisations so the settings stay identical across the enterprise.
- BDefine a repository ruleset at the enterprise tier that turns on secret scanning and code scanning whenever a branch matching the ruleset receives a push.
- CAssign the security manager role at the enterprise tier so the holders inherit a standard set of enabled features across all member organisations automatically.
- DCreate an enterprise-level security configuration, which the enterprise owner authors once and which then becomes available for organisation owners to apply to their repositories. Correct
Why A is wrong: There is no export-import flow for security configurations, and this still requires touching every organisation, which is exactly what the owner wants to avoid. It is tempting because copying config-as-code feels scalable, but it is not how the feature distributes baselines.
Why B is wrong: Rulesets govern branch and tag protections such as required checks and restricted pushes; they do not enable security features. The plausibility is that rulesets exist at enterprise scope, but they enforce branch rules rather than provision the scanning suite.
Why C is wrong: The security manager role grants permission to view and manage security settings and alerts; it does not bundle or push a feature baseline. Granting access is not the same as authoring and distributing a configuration, so this confuses a role with a configuration.
Why D is correct: Enterprise-level security configurations let an enterprise owner define a reusable baseline at the top tier that flows down to the organisations, where organisation owners can apply it. This matches authoring once and offering it downward without recreating settings per organisation.