A security architect is planning how to roll out a consistent security baseline across two estates: an estate of organisations on GitHub Enterprise Cloud and a separate self-hosted GitHub Enterprise Server instance. They intend to use the GitHub-provided security configuration as the apply-once baseline on the cloud estate and want to know whether the same configuration mechanism is available on the server estate. Which statement most accurately describes the difference in administration between the two platforms?
- ASecurity configurations apply identically on both platforms, so the architect can author one configuration on GitHub Enterprise Cloud and have the server instance pull it down automatically.
- BSecurity configurations exist only on GitHub Enterprise Server, while GitHub Enterprise Cloud relies entirely on per-repository toggles, so the architect must script the cloud estate by hand.
- CSecurity configurations are unavailable on both platforms and have been replaced by Dependabot version update rules, which now carry the secret scanning and code scanning settings.
- DSecurity configurations, including the GitHub-recommended baseline, are a way to apply features at scale, and the architect should confirm availability on their server version since the two platforms do not always have feature parity. Correct
Why A is wrong: There is no cross-platform sync where a cloud configuration is pulled into a server instance; the two estates are administered separately. The shared product names make a unified flow tempting, but the platforms do not share a single configuration store.
Why B is wrong: This inverts where the feature is most mature; security configurations are a cloud capability and the cloud estate need not be scripted repository by repository. The claim sounds like a server-versus-cloud trade-off, but it points the availability in the wrong direction.
Why C is wrong: Security configurations are a current administration feature, not a retired one, and Dependabot version updates do not carry secret scanning or code scanning settings. The mention of a real Dependabot mechanism is the lure, but it controls dependency updates, not the scanning suite.
Why D is correct: Security configurations apply features such as secret scanning with push protection and code scanning at scale, and GitHub Enterprise Server can lag GitHub Enterprise Cloud on newer administration features, so checking the installed server version is the correct approach. This captures the real parity gap between cloud and server.