ExamworthyExamworthy
Open the appStart free

GH-500 - GitHub Security suites administration - Section 6.3

Define enterprise and organization security policies and rulesets, configure enforcement boundaries, bypass permissions, exceptions, and security roles.

Define enterprise and organisation security policies and rulesets, setting enforcement boundaries that determine which repositories are covered and which teams hold bypass permissions. Configure the security manager role and policy exceptions to balance strict enforcement with the flexibility required for legitimate operational needs.

organization rulesetsenforcement boundariesbypass permissionssecurity managerpolicies

Practice question for this objective

Free sampleGitHub Security suites administrationmedium

An enterprise on GitHub Enterprise Cloud uses an enterprise policy to require that push protection for secret scanning is enabled and cannot be turned off by member organisations. An organisation owner inside that enterprise tries to disable push protection for one of their repositories because a team finds the blocking inconvenient. What governs whether the organisation owner can do this?

  • AThe organisation owner can disable it, because organisation-scope settings always take precedence over an enterprise policy that conflicts with a local preference.
  • BThe organisation owner can disable it for that single repository, because enterprise policies set defaults only and never restrict an explicit per-repository override.
  • CThe organisation owner cannot disable it, because an enforced enterprise policy removes the option at the organisation and repository levels beneath it. Correct
  • DThe organisation owner cannot disable it unless they first remove the repository from any security configuration, after which the enterprise policy stops applying to it.
Recognise that an enforced enterprise policy locks a security setting so organisations and repositories beneath cannot override it. Enterprise policies cascade downward, and when one is set to enforce rather than merely recommend, it removes the matching control at organisation and repository scope. A required push protection policy therefore leaves the organisation owner with no option to disable it on a repository below.

Why A is wrong: This reverses the precedence model; a more restrictive enterprise policy overrides a looser organisation choice, not the other way round. It is tempting because organisation owners do control many settings, but an enforced enterprise policy removes that local option.

Why B is wrong: Enterprise policies can be set to enforce, not merely recommend, which closes off per-repository overrides. The distinction between a default and an enforced policy is exactly the trap; treating every policy as just a default is the mistake.

Why C is correct: When an enterprise policy is set to enforce a setting such as push protection, the corresponding control is locked for the organisations and repositories below, so the option to disable is unavailable. The organisation owner therefore cannot turn push protection off.

Why D is wrong: Detaching a security configuration does not exempt a repository from an enforced enterprise policy; the policy applies regardless of configuration attachment. The mention of configurations is plausible, but it conflates two separate governance mechanisms.

See more GH-500 practice questions, answers explained.

More in this domain

Back to all GitHub Security suites administration objectives, or the GH-500 cert hub.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.