GH-500 - Configure and use supply chain security (18% of the exam) - Section 3.2

Detect, prioritize, and respond to Dependabot alerts and security updates, using EPSS scoring, auto-dismiss behaviour, and security campaigns.

Detect and prioritise Dependabot alerts using EPSS scoring to focus effort on vulnerabilities most likely to be exploited, and configure auto-dismiss rules to suppress low-priority noise. Use Dependabot security updates and security campaigns to coordinate remediation across multiple repositories at scale.

Dependabot alertsDependabot security updatesEPSSauto-dismisssecurity campaigns

Practice question for this objective

Free sampleConfigure and use supply chain securityhard

A security lead must choose how to run two pieces of work. Work item one is a one-off, audit-driven push to close roughly two hundred existing Dependabot alerts across forty repositories by a fixed date, with each alert assigned to an owning engineer. Work item two is an ongoing policy to keep build-time-only, low-impact alerts from cluttering the queue automatically as new ones arrive, without a person looking at each one. The lead wants to map each work item to the GitHub capability designed for it. Which TWO mappings are correct? Select TWO.

AWork item one is best served by a security campaign, because it bundles a fixed set of existing alerts, assigns owners, and tracks remediation against a deadline. Correct
BWork item two is best served by a Dependabot auto-triage rule, because it continuously and automatically dismisses newly arriving alerts that match low-impact criteria. Correct
CWork item one is best served by an auto-triage rule that auto-dismisses the two hundred alerts so the audit shows a clean queue, since both work items are really the same automation.
DWork item two is best served by a security campaign that is recreated each sprint, because campaigns are the only mechanism that can act on alerts without manual per-alert review.

Use security campaigns for time-bound owner-assigned remediation of curated alerts, and auto-triage rules for standing automatic dismissal of low-impact alerts. A security campaign is the right tool for a deadline-driven push to remediate a fixed, curated set of existing alerts with assigned owners, while a Dependabot auto-triage rule is the right tool for continuously and automatically dismissing newly arriving low-impact alerts against standing criteria, so the two work items map to different capabilities.

Why A is correct: A security campaign exists for exactly this time-bound, owner-assigned push against a curated set of existing alerts ahead of an audit.

Why B is correct: Auto-triage rules apply standing criteria to incoming alerts and auto-dismiss matches, which is the ongoing, hands-off filtering the second work item describes.

Why C is wrong: This is tempting because both involve many alerts, but auto-dismissing genuine alerts to fake a clean queue defeats the audit and ignores that a campaign tracks real remediation with owners and a deadline.

Why D is wrong: This misassigns the tools: campaigns coordinate human remediation of a curated set, whereas the ongoing automatic filtering the second item needs is the job of auto-triage rules.

See more GH-500 practice questions, answers explained.

Exam traps in Configure and use supply chain security

Answers that look right on this material and are not. Each one is a distractor from a different question in the GH-500 bank for this domain.

Dependabot automatically opens a version update pull request for the package on its next scheduled run, since version updates cover security fixes when security updates are off.
Why it is wrong: This is tempting because both features open pull requests, but version updates are configured separately in a dependabot.yml schedule and are not a fallback that delivers security fixes when security updates are disabled.
Creating a campaign automatically opens Dependabot security update pull requests for every alert in the campaign, so developers only need to merge the prepared fixes.
Why it is wrong: This is tempting because a campaign is about driving fixes, but a campaign does not generate pull requests; the remediation pull request still comes from Dependabot security updates, and a campaign only organises and tracks the work.
Creating a campaign automatically dismisses every alert it includes with the reason that remediation is scheduled, so the alerts disappear from the open queue for the campaign's duration.
Why it is wrong: This is tempting because a campaign implies a plan, but campaigns track alerts rather than dismissing them, so the alerts stay open until a developer resolves each one.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.